FlowiseAI/Flowise · error · Error

Invalid SQLite path: database path is required

Error message

Invalid SQLite path: database path is required

What it means

Thrown by validateSQLitePath (packages/components/src/validator.ts:333) when no database path is supplied (undefined, null, or whitespace-only). Unlike the vector store helper, validateSQLitePath has NO default file — SQLite requires an explicit path. (A default 'database.sqlite' is only used when PATH_TRAVERSAL_SAFETY=false.)

Source

Thrown at packages/components/src/validator.ts:333

 *
 * @param {string | undefined} userProvidedPath - File path supplied by the user in the node config
 * @returns {string} A validated, absolute path within an allowed base directory
 * @throws {Error} If the path is missing, contains traversal patterns, or is outside allowed directories
 */
export const validateSQLitePath = (userProvidedPath: string | undefined): string => {
    const allowedDirs = getAllowedSQLiteBaseDirs()
    const defaultDir = allowedDirs[0]

    if (process.env.PATH_TRAVERSAL_SAFETY === 'false') {
        if (!userProvidedPath || userProvidedPath.trim() === '') {
            return path.join(defaultDir, 'database.sqlite')
        }
        const bypassPath = userProvidedPath.trim()
        return path.isAbsolute(bypassPath) ? bypassPath : path.resolve(path.join(defaultDir, bypassPath))
    }

    if (!userProvidedPath || userProvidedPath.trim() === '') {
        throw new Error('Invalid SQLite path: database path is required')
    }

    const basePath = userProvidedPath.trim()

    if (basePath.includes('..')) throw new Error('Invalid SQLite path: path traversal attempt detected')
    if (basePath.toLowerCase().includes('%2e') || basePath.toLowerCase().includes('%2f') || basePath.toLowerCase().includes('%5c'))
        throw new Error('Invalid SQLite path: encoded path traversal attempt detected')
    // eslint-disable-next-line no-control-regex
    if (/\0/.test(basePath) || /[\x00-\x1f]/.test(basePath))
        throw new Error('Invalid SQLite path: null bytes or control characters detected')
    if (/^[a-zA-Z]:\\/.test(basePath)) throw new Error('Invalid SQLite path: Windows absolute paths are not allowed')
    if (/^\\\\[^\\]/.test(basePath)) throw new Error('Invalid SQLite path: UNC paths are not allowed')
    if (/^\\\\\?\\/.test(basePath)) throw new Error('Invalid SQLite path: extended-length paths are not allowed')

    const resolvedPath = path.isAbsolute(basePath) ? path.resolve(basePath) : path.resolve(path.join(defaultDir, basePath))

    if (resolvedPath.includes('..')) throw new Error('Invalid SQLite path: path traversal detected in resolved path')

View on GitHub (pinned to abe4a8601a)

Solutions

1. Provide an explicit SQLite file path, e.g. 'database.sqlite' (resolves to ~/.flowise/database.sqlite) or an absolute path under an allowed dir.
2. If importing an old chatflow, fill in the Database Path field and re-save.
3. When scripting chatflow creation, always set the databasePath node param.

Example fix

// before
validateSQLitePath(undefined)

// after
validateSQLitePath('database.sqlite')   // -> ~/.flowise/database.sqlite

if (typeof databasePath !== 'string' || databasePath.trim() === '') throw new Error('SQLite Database Path is required');

const isNonEmptyString = (p: unknown): p is string => typeof p === 'string' && p.trim() !== '';

try { validateSQLitePath(databasePath) } catch (e) { if (e instanceof Error && /database path is required/.test(e.message)) { databasePath = 'database.sqlite' } else throw e }

When it happens

Trigger: A SQL Database Chain / Sql Database node is created with an empty Database Path field, or the node param is omitted from the API/chatflow payload.

Common situations: New node config left blank because the UI did not mark the field required; migration from an older version that defaulted the path; programmatic chatflow creation that skips the field.

Related errors

• Invalid SQLite path: path must be within allowed directories
• Invalid SQLite path: path traversal attempt detected
• Invalid SQLite path: encoded path traversal attempt detected
• Invalid SQLite path: null bytes or control characters detect
• Invalid SQLite path: Windows absolute paths are not allowed

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/b3af461272e803a2. Report an issue: GitHub.