diff --git a/server/handles/fsmanage.go b/server/handles/fsmanage.go index 8247fa8cb..2a1c5e5a7 100644 --- a/server/handles/fsmanage.go +++ b/server/handles/fsmanage.go @@ -282,6 +282,11 @@ func FsRemove(c *gin.Context) { return } for _, name := range req.Names { + // Skip invalid item names (empty string, whitespace, ".", "/","\t\t","..") to prevent accidental removal of current directory + if strings.TrimSpace(utils.FixAndCleanPath(name)) == "/" { + utils.Log.Warnf("FsRemove: invalid item skipped: %s (parent directory: %s)\n", name, reqDir) + continue + } err := fs.Remove(c.Request.Context(), stdpath.Join(reqDir, name)) if err != nil { common.ErrorResp(c, err, 500)