From 54893f0dee48187c6ae4ab51113b6d9409cee253 Mon Sep 17 00:00:00 2001
From: Furox <real.furkannn@gmail.com>
Date: Fri, 4 Sep 2026 23:10:39 +0300
Subject: [PATCH] fix: reject unsafe restore path metacharacters

---
 packages/server/src/utils/volume-backups/restore.ts | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/packages/server/src/utils/volume-backups/restore.ts b/packages/server/src/utils/volume-backups/restore.ts
index 98e9847b0..4a080be2a 100644
--- a/packages/server/src/utils/volume-backups/restore.ts
+++ b/packages/server/src/utils/volume-backups/restore.ts
@@ -8,15 +8,22 @@ import {
 	paths,
 } from "../..";
 
+const UNSAFE_BACKUP_PATH_CHARS = /[\0\r\n;&|`$<>]/;
+
 export const normalizeVolumeBackupFilePath = (value: string) => {
 	const normalized = value.trim().replace(/\\/g, "/");
-	if (!normalized || normalized.startsWith("/") || normalized.endsWith("/")) {
+	if (
+		!normalized ||
+		normalized.startsWith("/") ||
+		normalized.endsWith("/") ||
+		UNSAFE_BACKUP_PATH_CHARS.test(normalized)
+	) {
 		throw new Error("Invalid volume backup file path");
 	}
 	const segments = normalized.split("/");
 	if (
 		segments.some(
-			(segment) => !segment || segment === "." || segment === ".." || segment.includes("\0"),
+			(segment) => !segment || segment === "." || segment === "..",
 		)
 	) {
 		throw new Error("Invalid volume backup file path");