FlowiseAI/Flowise · error · Error

Invalid SQLite path: encoded path traversal attempt detected

Error message

Invalid SQLite path: encoded path traversal attempt detected

What it means

Thrown by validateSQLitePath (packages/components/src/validator.ts:340) when the SQLite path contains URL-encoded traversal sequences %2e, %2f, or %5c (case-insensitive). Encoded '..' is a classic bypass for substring filters; Flowise rejects it before resolution.

Source

Thrown at packages/components/src/validator.ts:340

    const defaultDir = allowedDirs[0]

    if (process.env.PATH_TRAVERSAL_SAFETY === 'false') {
        if (!userProvidedPath || userProvidedPath.trim() === '') {
            return path.join(defaultDir, 'database.sqlite')
        }
        const bypassPath = userProvidedPath.trim()
        return path.isAbsolute(bypassPath) ? bypassPath : path.resolve(path.join(defaultDir, bypassPath))
    }

    if (!userProvidedPath || userProvidedPath.trim() === '') {
        throw new Error('Invalid SQLite path: database path is required')
    }

    const basePath = userProvidedPath.trim()

    if (basePath.includes('..')) throw new Error('Invalid SQLite path: path traversal attempt detected')
    if (basePath.toLowerCase().includes('%2e') || basePath.toLowerCase().includes('%2f') || basePath.toLowerCase().includes('%5c'))
        throw new Error('Invalid SQLite path: encoded path traversal attempt detected')
    // eslint-disable-next-line no-control-regex
    if (/\0/.test(basePath) || /[\x00-\x1f]/.test(basePath))
        throw new Error('Invalid SQLite path: null bytes or control characters detected')
    if (/^[a-zA-Z]:\\/.test(basePath)) throw new Error('Invalid SQLite path: Windows absolute paths are not allowed')
    if (/^\\\\[^\\]/.test(basePath)) throw new Error('Invalid SQLite path: UNC paths are not allowed')
    if (/^\\\\\?\\/.test(basePath)) throw new Error('Invalid SQLite path: extended-length paths are not allowed')

    const resolvedPath = path.isAbsolute(basePath) ? path.resolve(basePath) : path.resolve(path.join(defaultDir, basePath))

    if (resolvedPath.includes('..')) throw new Error('Invalid SQLite path: path traversal detected in resolved path')

    if (!isPathWithinAllowedSQLiteDirs(resolvedPath, allowedDirs)) {
        throw new Error(
            `Invalid SQLite path: path must be within allowed directories (${allowedDirs.join(', ')}). Attempted path: ${resolvedPath}`
        )
    }

    return resolvedPath

View on GitHub (pinned to abe4a8601a)

Solutions

1. decodeURIComponent() the input once, then pass a plain relative filename.
2. Use a simple filename with no percent sequences.
3. Sanitize upstream at the API boundary.

Example fix

// before
nodeParams.databasePath = req.query.db   // '%2e%2e/secret.db'

// after
nodeParams.databasePath = 'app.db'

const clean = (p) => decodeURIComponent(String(p ?? '')).replace(/[\x00-\x1f]/g, '');
if (/%2e|%2f|%5c/i.test(String(databasePath ?? '')) || clean(databasePath).includes('..')) throw new Error('reject encoded traversal');

const isDecodedSafe = (p: unknown): p is string => typeof p === 'string' && !/%2e|%2f|%5c/i.test(p) && !p.includes('..');

try { validateSQLitePath(databasePath) } catch (e) { if (e instanceof Error && /encoded path traversal/.test(e.message)) { databasePath = 'database.sqlite' } else throw e }

When it happens

Trigger: A Database Path value like '%2e%2e/app.db' or '..%2Fsecret.db' reaches validateSQLitePath, often because request/chat input was forwarded without decoding.

Common situations: Binding raw URL parameters into node config; double-encoding bugs; copy-pasting URL-style paths from docs.

Related errors

• Invalid SQLite path: path traversal attempt detected
• Invalid SQLite path: null bytes or control characters detect
• Invalid SQLite path: Windows absolute paths are not allowed
• Invalid SQLite path: UNC paths are not allowed
• Invalid SQLite path: path traversal detected in resolved pat

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/8b77f6893ade57bb. Report an issue: GitHub.