diff --git a/src/routes/+page.server.ts b/src/routes/+page.server.ts
index 82c39c8..b5467ba 100644
--- a/src/routes/+page.server.ts
+++ b/src/routes/+page.server.ts
@@ -138,6 +138,8 @@ export const load: PageServerLoad = async ({ cookies }) => {
                 stats = await fs.stat(filePath);
             } catch { continue; }
 
+            if (!stats.isFile()) continue;
+
             const nodoName = path.parse(file).name;
             let clientData: any = null;
 
diff --git a/src/routes/backup/+server.ts b/src/routes/backup/+server.ts
index 98b4807..e2d3519 100644
--- a/src/routes/backup/+server.ts
+++ b/src/routes/backup/+server.ts
@@ -15,8 +15,19 @@ export const GET = async ({ url }: { url: URL }) => {
         return new Response('Backup path is not configured', { status: 500 });
     }
 
+    const resolvedBase = path.resolve(basePath);
+    const filePath = path.resolve(resolvedBase, fileName);
+    const relativeToBase = path.relative(resolvedBase, filePath);
+    if (relativeToBase.startsWith('..') || path.isAbsolute(relativeToBase)) {
+        return new Response('Invalid file parameter', { status: 400 });
+    }
+
     try {
-        const filePath = path.join(basePath, fileName);
+        const st = await fs.stat(filePath);
+        if (!st.isFile()) {
+            console.error('Backup path is not a regular file:', filePath);
+            return new Response('Backup file not found or inaccessible', { status: 404 });
+        }
         console.log('Serving backup file from', filePath);
         const data = await fs.readFile(filePath);
         const headers = new Headers();