{"record":{"id":"911d10dc9ea24922","repo":"Comfy-Org/ComfyUI","slug":"error-saving-image-outside-the-output-folder","errorCode":null,"errorMessage":"**** ERROR: Saving image outside the output folder is not allowed.\\n full_output_folder: {full_output_folder}\\n         output_dir: {output_dir}","messagePattern":"\\*\\*\\*\\* ERROR: Saving image outside the output folder is not allowed\\.\\\\n full_output_folder: (.+?)\\\\n         output_dir: (.+?)","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"folder_paths.py","lineNumber":557,"sourceCode":"        input = input.replace(\"%hour%\", str(now.tm_hour).zfill(2))\n        input = input.replace(\"%minute%\", str(now.tm_min).zfill(2))\n        input = input.replace(\"%second%\", str(now.tm_sec).zfill(2))\n        return input\n\n    if \"%\" in filename_prefix:\n        filename_prefix = compute_vars(filename_prefix, image_width, image_height)\n\n    subfolder = os.path.dirname(os.path.normpath(filename_prefix))\n    filename = os.path.basename(os.path.normpath(filename_prefix))\n\n    full_output_folder = os.path.join(output_dir, subfolder)\n\n    if not is_within_directory(output_dir, full_output_folder):\n        err = \"**** ERROR: Saving image outside the output folder is not allowed.\" + \\\n              \"\\n full_output_folder: \" + os.path.abspath(full_output_folder) + \\\n              \"\\n         output_dir: \" + output_dir\n        logging.error(err)\n        raise Exception(err)\n\n    try:\n        counter = max(filter(lambda a: os.path.normcase(a[1][:-1]) == os.path.normcase(filename) and a[1][-1] == \"_\", map(map_filename, os.listdir(full_output_folder))))[0] + 1\n    except ValueError:\n        counter = 1\n    except FileNotFoundError:\n        os.makedirs(full_output_folder, exist_ok=True)\n        counter = 1\n    return full_output_folder, filename, counter, subfolder, filename_prefix\n\ndef get_input_subfolders() -> list[str]:\n    \"\"\"Returns a list of all subfolder paths in the input directory, recursively.\n\n    Returns:\n        List of folder paths relative to the input directory, excluding the root directory\n    \"\"\"\n    input_dir = get_input_directory()\n    folders = []","sourceCodeStart":539,"sourceCodeEnd":575,"githubUrl":"https://github.com/Comfy-Org/ComfyUI/blob/1c6d8d45b3693bfbb32385b410d813a7fd6be216/folder_paths.py#L539-L575","documentation":"get_save_image_path splits filename_prefix into subfolder + filename and joins them under output_dir; if the normalized prefix contains '../' components, full_output_folder resolves outside output_dir and is_within_directory fails. The node logs the error (paths included) and raises, preventing writes outside the designated output tree.","triggerScenarios":"A SaveImage/SaveVideo filename_prefix like '../../tmp/out' that escapes the output directory; workflow JSON with traversal-style prefixes; API-submitted prompts with crafted prefixes.","commonSituations":"Users trying to save directly to an arbitrary absolute path via the prefix; copied workflows from setups where the prefix implied a different directory structure; security probing of the queue API.","solutions":["Use a prefix with only subdirectory names (e.g. 'ComfyUI/myrun') relative to the output directory","To change the output root, configure the server's output directory setting instead of traversing with '../'","If automating, sanitize prefixes: strip '..' and absolute-path components before submission"],"exampleFix":"# before\nprefix = \"../../shared/renders\"\n# after\nprefix = \"renders\"  # saved under <output_dir>/renders/","handlingStrategy":"validation","validationCode":"import os\nn = os.path.normpath(filename_prefix)\nassert not os.path.isabs(n) and \"..\" not in n.split(os.sep), \"prefix must stay inside the output dir\"","typeGuard":"def is_safe_prefix(prefix: str) -> bool:\n    n = os.path.normpath(prefix)\n    return not os.path.isabs(n) and \"..\" not in n.split(os.sep)","tryCatchPattern":null,"preventionTips":["Use subfolder-style prefixes relative to the output directory only","Change the server output_dir configuration instead of traversing with '../'"],"tags":["security","path-traversal","save-image","output-folder"],"backgroundTag":null,"analyzedSha":"1c6d8d45b3693bfbb32385b410d813a7fd6be216","analyzedAt":"2026-08-14T19:37:18.893Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}