Warning, the Safe Path is empty, for safety reasons it is very important to create a folder in a path not accessible by an URL...
How to set up the Safe Path
VirtueMart uses a folder for storing invoices and downloadable files you eventually offer for sale. You must configure the path to this folder referred to as 'Safe Path'. For security reasons, it is recommended that this folder is outside of the public website folders.
To set up your 'Safe Path', first create a folder outside of your Joomla root (public html) directory using your ftp program. In this example we've created a folder named 'vmfiles' to be used as 'Safe Path'. When this is not possible create a folder in the 'administrator' folder of joomla.
Note that on some shared hosts, especially the low cost ones, you will not be able to set or access a folder below web root
Next you need to find out your server path to the folder. An easy way is to look at your Joomla 2.5 Global Configuration > Server tab > Server Settings 'Path to Temp Folder'. Just cut the '/html/tmp' (where 'html' is the public html folder) at the end and substitute it with the folder name you predefined as your 'Safe Path' folder, in our example '/vmfiles'.
In VM Configuration > Templates > Media File Settings enter the full server path to your folder into the 'Safe path' field. Some servers require a leading slash (i.e: /home/...). Do not create the '/invoices/' directory. VirtueMart will do that for you. And do not use a relative path, it will not work.