invoke-ai/InvokeAI · error

Backslashes not allowed in subfolder path

Error message

Backslashes not allowed in subfolder path

What it means

_validate_subfolder rejects any subfolder containing a backslash, since backslashes are Windows path separators and could smuggle extra path components or traversal. It raises ValueError('Backslashes not allowed in subfolder path').

Source

Thrown at invokeai/app/services/image_files/image_files_disk.py:283

        else:
            image_path = base_folder / basename

        # Ensure the image path is within the base folder to prevent directory traversal
        resolved_base = base_folder.resolve()
        resolved_image_path = image_path.resolve()

        if not resolved_image_path.is_relative_to(resolved_base):
            raise ValueError("Image path outside outputs folder, potential directory traversal detected")

        return resolved_image_path

    @staticmethod
    def _validate_subfolder(subfolder: str) -> None:
        """Validates a subfolder path to prevent directory traversal while allowing controlled subdirectories."""
        if not subfolder:
            return
        if "\\" in subfolder:
            raise ValueError("Backslashes not allowed in subfolder path")
        if subfolder.startswith("/"):
            raise ValueError("Absolute paths not allowed in subfolder path")
        parts = subfolder.split("/")
        for part in parts:
            if part == "..":
                raise ValueError("Parent directory references not allowed in subfolder path")
            if part == "":
                raise ValueError("Empty path segments not allowed in subfolder path")

    def validate_path(self, path: Union[str, Path]) -> bool:
        """Validates the path given for an image or thumbnail."""
        path = path if isinstance(path, Path) else Path(path)
        return path.exists()

    def get_workflow(self, image_name: str, image_subfolder: str = "") -> str | None:
        image = self.get(image_name, image_subfolder=image_subfolder)
        workflow = image.info.get("invokeai_workflow", None)
        if isinstance(workflow, str):

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Normalize separators: replace '\\' with '/' before calling
2. Build the subfolder with posixpath.join or '/'.join(parts) instead of os.path.join
3. Strip drive letters and backslashes at the config/API boundary

Example fix

// before
service.save(data, name, image_subfolder='board\\2024')
// after
service.save(data, name, image_subfolder='board/2024')

def normalize_subfolder(subfolder: str) -> str:
    return subfolder.replace('\\', '/').strip('/')
assert '\\' not in normalize_subfolder(sub)

def has_no_backslashes(s: object) -> bool:
    return isinstance(s, str) and '\\' not in s

try:
    service.save(data, name, image_subfolder=subfolder)
except ValueError as e:
    if 'Backslashes' in str(e):
        subfolder = subfolder.replace('\\', '/')
        service.save(data, name, image_subfolder=subfolder)

When it happens

Trigger: Passing image_subfolder containing '\\' to get/save/get_path, e.g. 'sub\\dir' or a Windows-style relative path copied from a config.

Common situations: Windows users pasting paths into board/subfolder settings; code using os.path.join on Windows which emits backslashes; serialized paths shared between OSes.

Related errors

• Absolute paths not allowed in subfolder path
• Empty path segments not allowed in subfolder path
• Empty path segments not allowed in subfolder path
• No external provider config fields provided
• str(e)

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/e14dfac1326ab549. Report an issue: GitHub.