langflow-ai/langflow · warning · HTTPException

Profile picture {safe_folder}/{safe_file} not found

Error message

Profile picture {safe_folder}/{safe_file} not found

What it means

Same download endpoint as above, but this variant means the resolved path passed the containment checks yet the file exists in neither config_dir/profile_pictures/<folder>/<file> nor the package-bundled langflow/initial_setup/setup/profile_pictures/<folder>/<file>. The folder name was allowed and the path was safe; the asset is simply absent in both lookup locations.

Source

Thrown at src/backend/base/langflow/api/v1/files.py:244

        candidate = os.path.realpath(os.path.join(allowed_base, safe_folder, safe_file))  # noqa: PTH118
        if candidate != allowed_base and not candidate.startswith(allowed_base + os.sep):
            raise HTTPException(status_code=404, detail="Profile picture not found")
        file_path = Path(candidate)

        # Fallback to package bundled profile pictures if not found in config_dir
        if not file_path.exists():
            from langflow.initial_setup import setup

            package_base = os.path.realpath(str(Path(setup.__file__).parent / "profile_pictures"))
            package_candidate = os.path.realpath(os.path.join(package_base, safe_folder, safe_file))  # noqa: PTH118
            if package_candidate != package_base and not package_candidate.startswith(package_base + os.sep):
                raise HTTPException(status_code=404, detail="Profile picture not found")

            package_path = Path(package_candidate)
            if package_path.exists():
                file_path = package_path
            else:
                raise HTTPException(status_code=404, detail=f"Profile picture {safe_folder}/{safe_file} not found")

        content_type = build_content_type_from_extension(extension)
        # Read file directly from local filesystem using async file operations
        file_content = await anyio.Path(file_path).read_bytes()
        return StreamingResponse(BytesIO(file_content), media_type=content_type)

    except HTTPException:
        raise
    except Exception as e:
        raise HTTPException(status_code=500, detail=str(e)) from e


@router.get("/profile_pictures/list")
async def list_profile_pictures(
    settings_service: Annotated[SettingsService, Depends(get_settings_service)],
):
    """List profile pictures from local filesystem.

View on GitHub (pinned to 976ec789d2)

Solutions

1. Call GET /api/v1/files/profile_pictures/list and confirm the exact '<folder>/<file>' string you are requesting appears in it
2. If missing, upload or copy the image into config_dir/profile_pictures/<allowed_folder>/ with the expected filename
3. After a version upgrade, refresh cached URLs (hard reload) since bundled avatars may have been renamed
4. Fall back to a default avatar client-side when this 404 is returned

Example fix

// before
const url = `/api/v1/files/profile_pictures/${folder}/${file}`;

// after: verify against the listing before use
const { files } = (await axios.get('/api/v1/files/profile_pictures/list')).data;
const key = `${folder}/${file}`;
const url = files.includes(key)
  ? `/api/v1/files/profile_pictures/${folder}/${file}`
  : DEFAULT_AVATAR;

const { files } = (await axios.get('/api/v1/files/profile_pictures/list')).data;
const exists = files.includes(`${folder}/${file}`);

catch (e) { if (e.response?.status === 404 && e.response.data?.detail?.includes('not found')) return DEFAULT_AVATAR; throw e; }

When it happens

Trigger: GET /profile_pictures/{folder}/{file} where folder is in the allowed set but the named file was deleted, renamed, or never existed — e.g. referencing an avatar that only existed in an older Langflow version whose bundled set changed, or a file deleted from config_dir while the UI still caches its URL.

Common situations: Upgrading Langflow and the bundled avatar set changed while browsers serve cached profile URLs; a config_dir was wiped or migrated; a flow/user record references an avatar filename that was custom on another machine; typos in the filename.

Related errors

• Profile picture not found
• Failed to load file (HTTP ${status})
• reload-in-progress
• Multiple files are not allowed
• An error occurred while uploading the file

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/15eb258602947211. Report an issue: GitHub.