diff --git a/routes/upload_routes.py b/routes/upload_routes.py
index 081c01d5c..b139a5a82 100644
--- a/routes/upload_routes.py
+++ b/routes/upload_routes.py
@@ -461,7 +461,10 @@ def setup_upload_routes(upload_handler):
# Skip generation during HEAD probe to avoid loading/processing whole image.
if thumb and mime.startswith("image/"):
thumb_dir = os.path.join(_upload_root(), ".thumbs")
- thumb_path = os.path.join(thumb_dir, file_id + ".jpg")
+ safe_file_id = os.path.basename(file_id)
+ thumb_path = os.path.join(thumb_dir, safe_file_id + ".jpg")
+ if not _path_inside_upload_dir(thumb_path) or not is_inside(thumb_dir, thumb_path):
+ raise HTTPException(403, "Access denied")
if request.method == "HEAD":
if (os.path.isfile(thumb_path)
and os.path.getmtime(thumb_path) >= os.path.getmtime(path)):
diff --git a/static/index.html b/static/index.html
index 8cfe83c21..aafacc2e1 100644
--- a/static/index.html
+++ b/static/index.html
@@ -257,7 +257,7 @@
-
+