FlowiseAI/Flowise · error · Error

Invalid path: Windows absolute paths are not allowed

Error message

Invalid path: Windows absolute paths are not allowed

What it means

Thrown by validateVectorStorePath (packages/components/src/validator.ts:246) when the base path matches ^[a-zA-Z]:\\ — a Windows drive-absolute path like 'C:\\data'. Flowise rejects drive letters even on Unix hosts to prevent cross-platform attack vectors and because the allow-list logic is built around POSIX-style ~/.flowise resolution.

Source

Thrown at packages/components/src/validator.ts:246

    // Check for explicit path traversal patterns (..)
    if (basePath.includes('..')) {
        throw new Error('Invalid path: path traversal attempt detected')
    }

    // Check for URL-encoded path traversal
    if (basePath.toLowerCase().includes('%2e') || basePath.toLowerCase().includes('%2f') || basePath.toLowerCase().includes('%5c')) {
        throw new Error('Invalid path: encoded path traversal attempt detected')
    }

    // Check for null bytes and control characters
    if (/\0/.test(basePath) || /[\x00-\x1f]/.test(basePath)) {
        throw new Error('Invalid path: null bytes or control characters detected')
    }

    // Check for Windows-specific absolute paths and UNC paths (even on Unix systems)
    // This prevents cross-platform attack vectors
    if (/^[a-zA-Z]:\\/.test(basePath)) {
        throw new Error('Invalid path: Windows absolute paths are not allowed')
    }
    if (/^\\\\[^\\]/.test(basePath)) {
        throw new Error('Invalid path: UNC paths are not allowed')
    }
    if (/^\\\\\?\\/.test(basePath)) {
        throw new Error('Invalid path: Extended-length paths are not allowed')
    }

    // Resolve to absolute path
    // If path is relative, resolve it relative to the .flowise directory (safe default)
    // If path is already absolute, keep it as-is
    let resolvedPath: string
    if (path.isAbsolute(basePath)) {
        resolvedPath = path.resolve(basePath)
    } else {
        // Relative paths are resolved within the .flowise directory for safety
        resolvedPath = path.resolve(path.join(getUserHome(), '.flowise', basePath))
    }

View on GitHub (pinned to abe4a8601a)

Solutions

1. Use a POSIX relative path or an absolute path under ~/.flowise.
2. On Windows, set BLOB_STORAGE_PATH to your desired drive folder and reference it relatively.
3. Replace backslashes with forward slashes and drop the drive letter.

Example fix

// before (Windows-authored config)
basePath = 'C:\\flowise\\vectors'

// after
basePath = 'vectors'   // resolves under ~/.flowise/vectors

if (/^[a-zA-Z]:\\/.test(String(basePath ?? ''))) throw new Error('Windows drive-absolute path rejected; use a POSIX path');

const isPosixPath = (p: unknown): p is string => typeof p === 'string' && !/^[a-zA-Z]:[\\/]/.test(p) && !p.includes('\\');

try { validateVectorStorePath(basePath) } catch (e) { if (e instanceof Error && /Windows absolute/.test(e.message)) { basePath = basePath.replace(/^[a-zA-Z]:[\\/]/, '') } else throw e }

When it happens

Trigger: A Windows-style path is supplied to a vector store node on any platform, e.g. 'C:\\Users\\me\\vectors' or 'D:\\data'.

Common situations: Developers on Windows copy-pasting local paths; config files shared across OSes; CI running Linux against a Windows-authored config.

Related errors

• Invalid path: UNC paths are not allowed
• Invalid path: Extended-length paths are not allowed
• Invalid SQLite path: Windows absolute paths are not allowed
• Invalid path: path traversal attempt detected
• Invalid path: encoded path traversal attempt detected

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/aadc5f4cf9682038. Report an issue: GitHub.