{"record":{"id":"b930b9ef72aa487f","repo":"FlowiseAI/Flowise","slug":"invalid-filename-unsafe-characters-or-path-traver","errorCode":null,"errorMessage":"Invalid filename: unsafe characters or path traversal attempt detected in filename \"${filename}\"","messagePattern":"Invalid filename: unsafe characters or path traversal attempt detected in filename \"(.+?)\"","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"critical","filePath":"packages/components/src/validator.ts","lineNumber":106,"sourceCode":"        /^[a-zA-Z]:\\\\/, // Absolute Windows paths (C:\\)\n        /^\\\\\\\\[^\\\\]/, // UNC paths (\\\\server\\)\n        /^\\\\\\\\\\?\\\\/ // Extended-length paths (\\\\?\\)\n    ]\n\n    return dangerousPatterns.some((pattern) => pattern.test(filePath))\n}\n\n/**\n * Validates filename format and security\n * @param {string} filename The filename to validate\n * @returns {void} Throws an error if validation fails\n */\nconst validateFilename = (filename: string): void => {\n    if (!filename || typeof filename !== 'string') {\n        throw new Error('Invalid filename: filename is required and must be a string')\n    }\n    if (isUnsafeFilePath(filename)) {\n        throw new Error(`Invalid filename: unsafe characters or path traversal attempt detected in filename \"${filename}\"`)\n    }\n}\n\n/**\n * Extracts and normalizes file extension from filename\n * @param {string} filename The filename\n * @returns {string} The normalized extension (lowercase, without dot) or empty string\n */\nconst extractFileExtension = (filename: string): string => {\n    const filenameParts = filename.split('.')\n    if (filenameParts.length <= 1) {\n        return ''\n    }\n    let ext = filenameParts.pop()!.toLowerCase()\n    // Normalize common extension variations to match MIME type mappings\n    const extensionNormalizationMap: { [key: string]: string } = {\n        jpeg: 'jpg', // image/jpeg and image/jpg both map to 'jpg'\n        tif: 'tiff', // image/tiff and image/tif both map to 'tiff'","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/validator.ts#L88-L124","documentation":"Thrown by validateFilename when isUnsafeFilePath(filename) returns true — i.e. the filename contains directory traversal (..), URL-encoded separators (%2f, %5c), null/control bytes, absolute paths, UNC paths, or extended-length path prefixes. This is the CVE path-traversal mitigation: filenames must be relative basenames.","triggerScenarios":"Uploader sends filename='../../etc/passwd' or '..%2f..%2fconfig'; filename contains a null byte ('file.txt\\0.exe'); filename is an absolute path ('/tmp/x') or Windows drive path ('C:\\x'); control characters embedded in the name.","commonSituations":"Malicious upload attempting directory traversal; client that sends full original paths instead of basenames; URL-encoded names not decoded before validation; legacy integration that legitimately uses subpaths (now rejected by design).","solutions":["Sanitize with a basename extraction (path.basename) before validation, or use the sanitize-filename library already imported.","Reject the upload with a 400 and require the client to send a plain basename.","Never concatenate user-supplied filenames into filesystem paths without re-validating the resolved path stays within the target dir."],"exampleFix":"// before\nvalidateFilename(filename) // throws on '../'\n\n// after — coerce to a safe basename first\nconst safeName = path.basename(filename || '').trim()\nvalidateFilename(safeName)\n// or use the imported sanitize() for stricter cleaning\nconst clean = sanitize(filename || '')\nvalidateFilename(clean)","handlingStrategy":"validation","validationCode":"import path from 'path'\nfunction toSafeBasename(filename: unknown): string {\n  return path.basename(typeof filename === 'string' ? filename : '').trim()\n}","typeGuard":"function isSafeBasename(filename: string): boolean {\n  return filename === path.basename(filename) && !/[\\\\/\\x00-\\x1f]/.test(filename) && !filename.includes('..')\n}","tryCatchPattern":"if (isUnsafeFilePath(filename)) {\n  throw new Error(`Invalid filename: unsafe characters or path traversal attempt detected in filename \"${filename}\"`)\n}","preventionTips":["Always coerce to path.basename() before validation.","Never interpolate user-supplied filenames into filesystem paths without re-validating the resolved path.","Run security tests with traversal payloads (../, %2e%2e, ..%2f, null byte) against the validator."],"tags":["security","path-traversal","file-upload","cve","validation"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}