{"record":{"id":"750718f53bdf93c2","repo":"FlowiseAI/Flowise","slug":"invalid-file-path","errorCode":null,"errorMessage":"Invalid file path","messagePattern":"Invalid file path","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/storage/LocalStorageProvider.ts","lineNumber":135,"sourceCode":"            throw error\n        }\n    }\n\n    async streamStorageFile(\n        chatflowId: string,\n        chatId: string,\n        fileName: string,\n        orgId: string\n    ): Promise<fs.ReadStream | Buffer | undefined> {\n        // Validate chatflowId and chatId\n        this.validateChatflowId(chatflowId)\n        this.validatePathSecurity(chatflowId, chatId)\n\n        const sanitizedFilename = this.sanitizeFilename(fileName)\n        const filePath = this.buildPath(orgId, chatflowId, chatId, sanitizedFilename)\n\n        //raise error if file path is not absolute\n        if (!path.isAbsolute(filePath)) throw new Error(`Invalid file path`)\n        //raise error if file path contains '..'\n        if (filePath.includes('..')) throw new Error(`Invalid file path`)\n        //only return from the storage folder\n        if (!filePath.startsWith(this.storagePath)) throw new Error(`Invalid file path`)\n\n        if (fs.existsSync(filePath)) {\n            return fs.createReadStream(filePath)\n        } else {\n            // Fallback: Check if file exists without orgId\n            const fallbackPath = this.buildPath(chatflowId, chatId, sanitizedFilename)\n\n            if (fs.existsSync(fallbackPath)) {\n                // Create directory if it doesn't exist\n                const dir = path.dirname(filePath)\n                if (!fs.existsSync(dir)) {\n                    fs.mkdirSync(dir, { recursive: true })\n                }\n","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/storage/LocalStorageProvider.ts#L117-L153","documentation":"First of three defense-in-depth guards in LocalStorageProvider.streamStorageFile. After buildPath constructs the absolute path, it asserts the result is absolute. A non-absolute result would indicate BLOB_STORAGE_PATH or getUserHome() resolved to a relative base, which the provider refuses to serve from.","triggerScenarios":"BLOB_STORAGE_PATH set to a relative value (e.g. `./storage`) or the user home resolution failing, so path.join produces a relative filePath. The guard is `!path.isAbsolute(filePath)` at LocalStorageProvider.ts:135.","commonSituations":"Setting BLOB_STORAGE_PATH to a relative path in .env; running under a service account whose HOME is unset so getUserHome() returns a relative fallback.","solutions":["Set BLOB_STORAGE_PATH to an absolute path, e.g. `/var/lib/flowise/storage`.","Ensure HOME (or the platform equivalent) is defined for the process so the default storage path resolves absolutely.","Restart Flowise after correcting the env var."],"exampleFix":"# before\nBLOB_STORAGE_PATH=./storage\n# after\nBLOB_STORAGE_PATH=/var/lib/flowise/storage","handlingStrategy":"validation","validationCode":"function requireAbsoluteStoragePath(): string {\n  const p = process.env.BLOB_STORAGE_PATH || path.join(getUserHome(), '.flowise', 'storage')\n  if (!path.isAbsolute(p)) throw new Error('BLOB_STORAGE_PATH must be an absolute path')\n  return p\n}","typeGuard":"function isAbsoluteStoragePath(p: string): boolean {\n  return path.isAbsolute(p)\n}","tryCatchPattern":null,"preventionTips":["Set BLOB_STORAGE_PATH to an absolute directory.","Ensure HOME is set for the process.","Validate the storage path at startup."],"tags":["security","storage","local","configuration"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}