{"record":{"id":"68cb45d00702bc4d","repo":"FlowiseAI/Flowise","slug":"invalid-path-path-traversal-attempt-detected","errorCode":null,"errorMessage":"Invalid path: path traversal attempt detected","messagePattern":"Invalid path: path traversal attempt detected","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/validator.ts","lineNumber":230,"sourceCode":"export const validateVectorStorePath = (userProvidedPath: string | undefined): string => {\n    if (process.env.PATH_TRAVERSAL_SAFETY === 'false') {\n        if (!userProvidedPath || userProvidedPath.trim() === '') {\n            return path.join(getUserHome(), '.flowise', 'vectorstore')\n        }\n        const bypassPath = userProvidedPath.trim()\n        return path.isAbsolute(bypassPath) ? bypassPath : path.resolve(path.join(getUserHome(), '.flowise', bypassPath))\n    }\n\n    // If no path provided, use default secure location\n    if (!userProvidedPath || userProvidedPath.trim() === '') {\n        return path.join(getUserHome(), '.flowise', 'vectorstore')\n    }\n\n    const basePath = userProvidedPath.trim()\n\n    // Check for explicit path traversal patterns (..)\n    if (basePath.includes('..')) {\n        throw new Error('Invalid path: path traversal attempt detected')\n    }\n\n    // Check for URL-encoded path traversal\n    if (basePath.toLowerCase().includes('%2e') || basePath.toLowerCase().includes('%2f') || basePath.toLowerCase().includes('%5c')) {\n        throw new Error('Invalid path: encoded path traversal attempt detected')\n    }\n\n    // Check for null bytes and control characters\n    if (/\\0/.test(basePath) || /[\\x00-\\x1f]/.test(basePath)) {\n        throw new Error('Invalid path: null bytes or control characters detected')\n    }\n\n    // Check for Windows-specific absolute paths and UNC paths (even on Unix systems)\n    // This prevents cross-platform attack vectors\n    if (/^[a-zA-Z]:\\\\/.test(basePath)) {\n        throw new Error('Invalid path: Windows absolute paths are not allowed')\n    }\n    if (/^\\\\\\\\[^\\\\]/.test(basePath)) {","sourceCodeStart":212,"sourceCodeEnd":248,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/validator.ts#L212-L248","documentation":"Thrown by validateVectorStorePath (packages/components/src/validator.ts:230) when the user-supplied vector store base path contains a literal '..' substring. Flowise runs this check before Faiss/SimpleStore and similar nodes open a directory, so a crafted node config cannot escape ~/.flowise. It is the first staged check (followed by encoded-traversal, control-char, absolute/UNC, and allow-list checks).","triggerScenarios":"A vector store node is configured with a Base Path containing '..', e.g. '../../etc', 'data/../shared', or even a filename with consecutive dots like 'my..store'. Any substring match of '..' trips it.","commonSituations":"Relative paths intended to point outside the data dir; copy-pasted examples that assume a different CWD; symlink-style '../data' shortcuts; legitimate filenames that happen to contain '..'.","solutions":["Use a simple relative name (e.g. 'myStore') and let Flowise resolve it under ~/.flowise.","Use an absolute path that lives under an allowed dir (~/.flowise or BLOB_STORAGE_PATH).","Rename any filename containing '..' (e.g. 'vec..1' -> 'vec_1').","Set PATH_TRAVERSAL_SAFETY=false to disable all traversal checks (not recommended, security regression)."],"exampleFix":"// before\nnodeParams.basePath = '../../shared/vectors'\n\n// after\nnodeParams.basePath = 'shared-vectors'   // resolves to ~/.flowise/shared-vectors","handlingStrategy":"validation","validationCode":"const isSafeRelativePath = (p) => typeof p === 'string' && p.trim() !== '' && !p.includes('..') && !/%2e|%2f|%5c/i.test(p) && !/[\\x00-\\x1f]/.test(p) && !/^[a-zA-Z]:\\\\/.test(p) && !/^\\\\\\\\[^\\\\]/.test(p);\nif (!isSafeRelativePath(basePath)) throw new Error('basePath failed pre-validation');","typeGuard":"const isPlainRelativePath = (p: unknown): p is string => typeof p === 'string' && p.trim() !== '' && !p.includes('..') && !/[\\\\/]/.test(p.trim().split('/').pop() ?? '');","tryCatchPattern":"try { const resolved = validateVectorStorePath(basePath) } catch (e) { if (e instanceof Error && e.message.startsWith('Invalid path:')) { /* surface to user */ } else throw e }","preventionTips":["Always use simple relative names for vector stores so Flowise resolves them under ~/.flowise.","Sanitize user/URL input (decode, strip control chars, reject '..') at the API boundary before it reaches node config.","Set BLOB_STORAGE_PATH explicitly when you need data outside the default dir."],"tags":["path-traversal","security","validation","vector-store","flowise","filesystem"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}