{"record":{"id":"aadc5f4cf9682038","repo":"FlowiseAI/Flowise","slug":"invalid-path-windows-absolute-paths-are-not-allow","errorCode":null,"errorMessage":"Invalid path: Windows absolute paths are not allowed","messagePattern":"Invalid path: Windows absolute paths are not allowed","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/validator.ts","lineNumber":246,"sourceCode":"    // Check for explicit path traversal patterns (..)\n    if (basePath.includes('..')) {\n        throw new Error('Invalid path: path traversal attempt detected')\n    }\n\n    // Check for URL-encoded path traversal\n    if (basePath.toLowerCase().includes('%2e') || basePath.toLowerCase().includes('%2f') || basePath.toLowerCase().includes('%5c')) {\n        throw new Error('Invalid path: encoded path traversal attempt detected')\n    }\n\n    // Check for null bytes and control characters\n    if (/\\0/.test(basePath) || /[\\x00-\\x1f]/.test(basePath)) {\n        throw new Error('Invalid path: null bytes or control characters detected')\n    }\n\n    // Check for Windows-specific absolute paths and UNC paths (even on Unix systems)\n    // This prevents cross-platform attack vectors\n    if (/^[a-zA-Z]:\\\\/.test(basePath)) {\n        throw new Error('Invalid path: Windows absolute paths are not allowed')\n    }\n    if (/^\\\\\\\\[^\\\\]/.test(basePath)) {\n        throw new Error('Invalid path: UNC paths are not allowed')\n    }\n    if (/^\\\\\\\\\\?\\\\/.test(basePath)) {\n        throw new Error('Invalid path: Extended-length paths are not allowed')\n    }\n\n    // Resolve to absolute path\n    // If path is relative, resolve it relative to the .flowise directory (safe default)\n    // If path is already absolute, keep it as-is\n    let resolvedPath: string\n    if (path.isAbsolute(basePath)) {\n        resolvedPath = path.resolve(basePath)\n    } else {\n        // Relative paths are resolved within the .flowise directory for safety\n        resolvedPath = path.resolve(path.join(getUserHome(), '.flowise', basePath))\n    }","sourceCodeStart":228,"sourceCodeEnd":264,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/validator.ts#L228-L264","documentation":"Thrown by validateVectorStorePath (packages/components/src/validator.ts:246) when the base path matches ^[a-zA-Z]:\\\\ — a Windows drive-absolute path like 'C:\\\\data'. Flowise rejects drive letters even on Unix hosts to prevent cross-platform attack vectors and because the allow-list logic is built around POSIX-style ~/.flowise resolution.","triggerScenarios":"A Windows-style path is supplied to a vector store node on any platform, e.g. 'C:\\\\Users\\\\me\\\\vectors' or 'D:\\\\data'.","commonSituations":"Developers on Windows copy-pasting local paths; config files shared across OSes; CI running Linux against a Windows-authored config.","solutions":["Use a POSIX relative path or an absolute path under ~/.flowise.","On Windows, set BLOB_STORAGE_PATH to your desired drive folder and reference it relatively.","Replace backslashes with forward slashes and drop the drive letter."],"exampleFix":"// before (Windows-authored config)\nbasePath = 'C:\\\\flowise\\\\vectors'\n\n// after\nbasePath = 'vectors'   // resolves under ~/.flowise/vectors","handlingStrategy":"validation","validationCode":"if (/^[a-zA-Z]:\\\\/.test(String(basePath ?? ''))) throw new Error('Windows drive-absolute path rejected; use a POSIX path');","typeGuard":"const isPosixPath = (p: unknown): p is string => typeof p === 'string' && !/^[a-zA-Z]:[\\\\/]/.test(p) && !p.includes('\\\\');","tryCatchPattern":"try { validateVectorStorePath(basePath) } catch (e) { if (e instanceof Error && /Windows absolute/.test(e.message)) { basePath = basePath.replace(/^[a-zA-Z]:[\\\\/]/, '') } else throw e }","preventionTips":["Normalize Windows-authored paths to POSIX before deploying cross-platform.","Prefer relative names so the host OS is irrelevant.","Add a CI check that rejects drive-letter paths in committed configs."],"tags":["path-traversal","security","validation","windows","cross-platform","vector-store","flowise"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}