{"record":{"id":"fbadf5c1ccc9293b","repo":"FlowiseAI/Flowise","slug":"invalid-path-unc-paths-are-not-allowed","errorCode":null,"errorMessage":"Invalid path: UNC paths are not allowed","messagePattern":"Invalid path: UNC paths are not allowed","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/validator.ts","lineNumber":249,"sourceCode":"    }\n\n    // Check for URL-encoded path traversal\n    if (basePath.toLowerCase().includes('%2e') || basePath.toLowerCase().includes('%2f') || basePath.toLowerCase().includes('%5c')) {\n        throw new Error('Invalid path: encoded path traversal attempt detected')\n    }\n\n    // Check for null bytes and control characters\n    if (/\\0/.test(basePath) || /[\\x00-\\x1f]/.test(basePath)) {\n        throw new Error('Invalid path: null bytes or control characters detected')\n    }\n\n    // Check for Windows-specific absolute paths and UNC paths (even on Unix systems)\n    // This prevents cross-platform attack vectors\n    if (/^[a-zA-Z]:\\\\/.test(basePath)) {\n        throw new Error('Invalid path: Windows absolute paths are not allowed')\n    }\n    if (/^\\\\\\\\[^\\\\]/.test(basePath)) {\n        throw new Error('Invalid path: UNC paths are not allowed')\n    }\n    if (/^\\\\\\\\\\?\\\\/.test(basePath)) {\n        throw new Error('Invalid path: Extended-length paths are not allowed')\n    }\n\n    // Resolve to absolute path\n    // If path is relative, resolve it relative to the .flowise directory (safe default)\n    // If path is already absolute, keep it as-is\n    let resolvedPath: string\n    if (path.isAbsolute(basePath)) {\n        resolvedPath = path.resolve(basePath)\n    } else {\n        // Relative paths are resolved within the .flowise directory for safety\n        resolvedPath = path.resolve(path.join(getUserHome(), '.flowise', basePath))\n    }\n\n    // Verify the resolved path doesn't contain '..' after resolution\n    if (resolvedPath.includes('..')) {","sourceCodeStart":231,"sourceCodeEnd":267,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/validator.ts#L231-L267","documentation":"Thrown by validateVectorStorePath (packages/components/src/validator.ts:249) when the base path matches ^\\\\\\\\[^\\\\] — a UNC path such as '\\\\\\\\server\\\\share'. UNC paths can reach arbitrary network locations, so Flowise forbids them regardless of host OS.","triggerScenarios":"A vector store node is configured with a UNC path like '\\\\\\\\fileserver\\\\ai\\\\vectors' or '\\\\\\\\localhost\\\\c$\\\\data'.","commonSituations":"Windows shop mounting vector data on a network share; containers inheriting SMB-mounted configs; copy-pasting paths from a UNC-mapped drive.","solutions":["Mount the network share locally and reference it via an allowed absolute path (~/.flowise or BLOB_STORAGE_PATH).","Copy the data into ~/.flowise/<name> and use that relative name.","If a network location is truly required, expose it via BLOB_STORAGE_PATH and ensure the resolved path stays inside it."],"exampleFix":"// before\nbasePath = '\\\\\\\\fileserver\\\\ai\\\\vectors'\n\n// after\nbasePath = 'vectors'   // data copied/mounted under ~/.flowise/vectors","handlingStrategy":"validation","validationCode":"if (/^\\\\\\\\[^\\\\]/.test(String(basePath ?? ''))) throw new Error('UNC paths not supported; use a local mount');","typeGuard":"const isNotUnc = (p: unknown): p is string => typeof p === 'string' && !/^\\\\\\\\[^\\\\]/.test(p);","tryCatchPattern":"try { validateVectorStorePath(basePath) } catch (e) { if (e instanceof Error && /UNC paths/.test(e.message)) { throw new Error('mount the share locally and retry') } else throw e }","preventionTips":["Mount network shares to a local path and reference that path.","Never commit UNC paths to node configs.","Document the BLOB_STORAGE_PATH convention for your team."],"tags":["path-traversal","security","validation","unc","windows","network","vector-store","flowise"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}