{"record":{"id":"dca5b0d2399fdf27","repo":"FlowiseAI/Flowise","slug":"invalid-path-encoded-path-traversal-attempt-detec","errorCode":null,"errorMessage":"Invalid path: encoded path traversal attempt detected","messagePattern":"Invalid path: encoded path traversal attempt detected","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/validator.ts","lineNumber":235,"sourceCode":"        const bypassPath = userProvidedPath.trim()\n        return path.isAbsolute(bypassPath) ? bypassPath : path.resolve(path.join(getUserHome(), '.flowise', bypassPath))\n    }\n\n    // If no path provided, use default secure location\n    if (!userProvidedPath || userProvidedPath.trim() === '') {\n        return path.join(getUserHome(), '.flowise', 'vectorstore')\n    }\n\n    const basePath = userProvidedPath.trim()\n\n    // Check for explicit path traversal patterns (..)\n    if (basePath.includes('..')) {\n        throw new Error('Invalid path: path traversal attempt detected')\n    }\n\n    // Check for URL-encoded path traversal\n    if (basePath.toLowerCase().includes('%2e') || basePath.toLowerCase().includes('%2f') || basePath.toLowerCase().includes('%5c')) {\n        throw new Error('Invalid path: encoded path traversal attempt detected')\n    }\n\n    // Check for null bytes and control characters\n    if (/\\0/.test(basePath) || /[\\x00-\\x1f]/.test(basePath)) {\n        throw new Error('Invalid path: null bytes or control characters detected')\n    }\n\n    // Check for Windows-specific absolute paths and UNC paths (even on Unix systems)\n    // This prevents cross-platform attack vectors\n    if (/^[a-zA-Z]:\\\\/.test(basePath)) {\n        throw new Error('Invalid path: Windows absolute paths are not allowed')\n    }\n    if (/^\\\\\\\\[^\\\\]/.test(basePath)) {\n        throw new Error('Invalid path: UNC paths are not allowed')\n    }\n    if (/^\\\\\\\\\\?\\\\/.test(basePath)) {\n        throw new Error('Invalid path: Extended-length paths are not allowed')\n    }","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/validator.ts#L217-L253","documentation":"Thrown by validateVectorStorePath (packages/components/src/validator.ts:235) when the base path contains URL-encoded traversal sequences %2e (.), %2f (/) or %5c (\\), case-insensitive. Attackers encode '..' to slip past naive substring filters; Flowise decodes the intent and rejects it before the path reaches the filesystem.","triggerScenarios":"A node config passes a path like '%2e%2e%2fetc', '..%2F..%2Fpasswd', or any value carrying %2e/%2f/%5c, including values forwarded from URL query params or chattools without decoding first.","commonSituations":"Passing request parameters straight into node config; double-encoding bugs where a framework already decoded once; copy-pasting URL-style paths from documentation.","solutions":["decodeURIComponent() user input once before binding it to the node config, then pass a plain relative path.","Use a plain relative name under ~/.flowise (no percent signs).","Validate/sanitize upstream so encoded traversal never reaches Flowise.","If you genuinely need encoded chars in a filename, pick names without %2e/%2f/%5c."],"exampleFix":"// before\nnodeParams.basePath = req.query.path   // '%2e%2e%2fetc'\n\n// after\nnodeParams.basePath = decodeURIComponent(req.query.path).replace(/\\.\\./g, '')\n// better: nodeParams.basePath = 'my-vectors'","handlingStrategy":"validation","validationCode":"const clean = (p) => decodeURIComponent(String(p ?? '')).replace(/[\\x00-\\x1f]/g, '');\nif (clean(p).includes('..') || /%2e|%2f|%5c/i.test(p)) throw new Error('reject encoded traversal upstream');","typeGuard":"const isDecodedSafePath = (p: unknown): p is string => typeof p === 'string' && !p.includes('..') && !/%2e|%2f|%5c/i.test(p);","tryCatchPattern":"try { validateVectorStorePath(basePath) } catch (e) { if (e instanceof Error && /encoded path traversal/.test(e.message)) { basePath = 'fallback-store' } else throw e }","preventionTips":["Decode percent-encoded input exactly once before binding to node config.","Reject any path containing %2e/%2f/%5c at the request boundary.","Never forward raw URL query params straight into vector store config."],"tags":["path-traversal","security","validation","url-encoding","vector-store","flowise"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}