{"record":{"id":"347b38777ed59ab0","repo":"FlowiseAI/Flowise","slug":"invalid-path-path-must-be-within-allowed-director","errorCode":null,"errorMessage":"Invalid path: path must be within allowed directories (${allowedDirs.join(', ')}). Attempted path: ${resolvedPath}","messagePattern":"Invalid path: path must be within allowed directories \\((.+?)\\)\\. Attempted path: (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/validator.ts","lineNumber":280,"sourceCode":"        // Relative paths are resolved within the .flowise directory for safety\n        resolvedPath = path.resolve(path.join(getUserHome(), '.flowise', basePath))\n    }\n\n    // Verify the resolved path doesn't contain '..' after resolution\n    if (resolvedPath.includes('..')) {\n        throw new Error('Invalid path: path traversal detected in resolved path')\n    }\n\n    // Check if resolved path is within allowed directories\n    const allowedDirs = getAllowedVectorStoreBaseDirs()\n    const isWithinAllowedDir = allowedDirs.some((allowedDir) => {\n        const normalizedResolved = normalizePlatformPath(resolvedPath)\n        const normalizedAllowed = normalizePlatformPath(allowedDir)\n        return normalizedResolved === normalizedAllowed || normalizedResolved.startsWith(normalizedAllowed + path.sep)\n    })\n\n    if (!isWithinAllowedDir) {\n        throw new Error(\n            `Invalid path: path must be within allowed directories (${allowedDirs.join(', ')}). ` + `Attempted path: ${resolvedPath}`\n        )\n    }\n\n    return resolvedPath\n}\n\nconst getAllowedSQLiteBaseDirs = (): string[] => {\n    const dirs = [path.join(getUserHome(), '.flowise')]\n    if (process.env.DATABASE_PATH) {\n        dirs.push(path.resolve(process.env.DATABASE_PATH))\n    }\n    return dirs\n}\n\nconst normalizePlatformPath = (p: string): string => {\n    const n = path.normalize(p)\n    return process.platform === 'win32' ? n.toLowerCase() : n","sourceCodeStart":262,"sourceCodeEnd":298,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/validator.ts#L262-L298","documentation":"Thrown by validateVectorStorePath (packages/components/src/validator.ts:280) when the fully resolved absolute path is not inside any allowed base directory. Allowed dirs are ~/.flowise plus BLOB_STORAGE_PATH (if set). The error message names the allowed dirs and the attempted path to aid debugging.","triggerScenarios":"An absolute path points outside ~/.flowise (and outside BLOB_STORAGE_PATH when unset), e.g. '/var/lib/mydata', '/tmp/vectors', or a relative path that resolves outside the allow-list via a symlink.","commonSituations":"Wanting to store vectors on a separate volume; Docker volume mounts outside the default dir; production deployments needing a custom data dir.","solutions":["Set BLOB_STORAGE_PATH=/your/data/dir and use paths inside it.","Use a relative name so Flowise resolves under ~/.flowise automatically.","Symlink your target directory into ~/.flowise and reference the symlink by its relative name.","Confirm HOME (or USERPROFILE on Windows) points where you expect — getUserHome() drives ~/.flowise."],"exampleFix":"// before\nprocess.env.BLOB_STORAGE_PATH = ''   // unset\nnodeParams.basePath = '/mnt/data/vectors'\n\n// after\nprocess.env.BLOB_STORAGE_PATH = '/mnt/data'\nnodeParams.basePath = '/mnt/data/vectors'   // now inside the allow-list","handlingStrategy":"validation","validationCode":"const { resolve, join } = require('path');\nconst allowed = [join(require('os').homedir(), '.flowise')];\nif (process.env.BLOB_STORAGE_PATH) allowed.push(resolve(process.env.BLOB_STORAGE_PATH));\nconst r = resolve(basePath);\nif (!allowed.some((d) => r === d || r.startsWith(d + require('path').sep))) throw new Error('path outside allow-list: ' + r);","typeGuard":"const isWithinAllowed = (p: string, allowed: string[]): p is string => allowed.some((d) => p === d || p.startsWith(d + '/'));","tryCatchPattern":"try { validateVectorStorePath(basePath) } catch (e) { if (e instanceof Error && /within allowed directories/.test(e.message)) { throw new Error('set BLOB_STORAGE_PATH or move data under ~/.flowise') } else throw e }","preventionTips":["Set BLOB_STORAGE_PATH when you need vector data outside ~/.flowise.","Verify HOME/USERPROFILE points where you expect.","Symlink external volumes into ~/.flowise and use relative names."],"tags":["path-traversal","security","validation","filesystem","configuration","env","vector-store","flowise"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}