diff --git a/package-lock.json b/package-lock.json
index 0a9e4d1b8..26a035629 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
     "name": "TavernAI",
-    "version": "1.2.8",
+    "version": "1.1.0",
     "lockfileVersion": 2,
     "requires": true,
     "packages": {
         "": {
             "name": "TavernAI",
-            "version": "1.2.8",
+            "version": "1.1.0",
             "dependencies": {
                 "cookie-parser": "^1.4.6",
                 "cors": "^2.8.5",
@@ -20,7 +20,8 @@
                 "png-chunk-text": "^1.0.0",
                 "png-chunks-encode": "^1.0.0",
                 "png-chunks-extract": "^1.0.0",
-                "rimraf": "^3.0.2"
+                "rimraf": "^3.0.2",
+                "sanitize-filename": "^1.6.3"
             },
             "bin": {
                 "TavernAI": "server.js"
@@ -1637,6 +1638,14 @@
             "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
             "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
         },
+        "node_modules/sanitize-filename": {
+            "version": "1.6.3",
+            "resolved": "https://registry.npmjs.org/sanitize-filename/-/sanitize-filename-1.6.3.tgz",
+            "integrity": "sha512-y/52Mcy7aw3gRm7IrcGDFx/bCk4AhRh2eI9luHOQM86nZsqwiRkkq2GekHXBBD+SmPidc8i2PqtYZl+pWJ8Oeg==",
+            "dependencies": {
+                "truncate-utf8-bytes": "^1.0.0"
+            }
+        },
         "node_modules/sax": {
             "version": "1.2.4",
             "resolved": "https://registry.npmjs.org/sax/-/sax-1.2.4.tgz",
@@ -1804,6 +1813,14 @@
             "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
             "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw=="
         },
+        "node_modules/truncate-utf8-bytes": {
+            "version": "1.0.2",
+            "resolved": "https://registry.npmjs.org/truncate-utf8-bytes/-/truncate-utf8-bytes-1.0.2.tgz",
+            "integrity": "sha512-95Pu1QXQvruGEhv62XCMO3Mm90GscOCClvrIUwCM0PYOXK3kaF3l3sIHxx71ThJfcbM2O5Au6SO3AWCSEfW4mQ==",
+            "dependencies": {
+                "utf8-byte-length": "^1.0.1"
+            }
+        },
         "node_modules/type-is": {
             "version": "1.6.18",
             "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
@@ -1829,6 +1846,11 @@
                 "node": ">= 0.8"
             }
         },
+        "node_modules/utf8-byte-length": {
+            "version": "1.0.4",
+            "resolved": "https://registry.npmjs.org/utf8-byte-length/-/utf8-byte-length-1.0.4.tgz",
+            "integrity": "sha512-4+wkEYLBbWxqTahEsWrhxepcoVOJ+1z5PGIjPZxRkytcdSUaNjIjBM7Xn8E+pdSuV7SzvWovBFA54FO0JSoqhA=="
+        },
         "node_modules/utif2": {
             "version": "4.0.1",
             "resolved": "https://registry.npmjs.org/utif2/-/utif2-4.0.1.tgz",
@@ -3133,6 +3155,14 @@
             "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
             "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
         },
+        "sanitize-filename": {
+            "version": "1.6.3",
+            "resolved": "https://registry.npmjs.org/sanitize-filename/-/sanitize-filename-1.6.3.tgz",
+            "integrity": "sha512-y/52Mcy7aw3gRm7IrcGDFx/bCk4AhRh2eI9luHOQM86nZsqwiRkkq2GekHXBBD+SmPidc8i2PqtYZl+pWJ8Oeg==",
+            "requires": {
+                "truncate-utf8-bytes": "^1.0.0"
+            }
+        },
         "sax": {
             "version": "1.2.4",
             "resolved": "https://registry.npmjs.org/sax/-/sax-1.2.4.tgz",
@@ -3274,6 +3304,14 @@
             "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
             "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw=="
         },
+        "truncate-utf8-bytes": {
+            "version": "1.0.2",
+            "resolved": "https://registry.npmjs.org/truncate-utf8-bytes/-/truncate-utf8-bytes-1.0.2.tgz",
+            "integrity": "sha512-95Pu1QXQvruGEhv62XCMO3Mm90GscOCClvrIUwCM0PYOXK3kaF3l3sIHxx71ThJfcbM2O5Au6SO3AWCSEfW4mQ==",
+            "requires": {
+                "utf8-byte-length": "^1.0.1"
+            }
+        },
         "type-is": {
             "version": "1.6.18",
             "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
@@ -3293,6 +3331,11 @@
             "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
             "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ=="
         },
+        "utf8-byte-length": {
+            "version": "1.0.4",
+            "resolved": "https://registry.npmjs.org/utf8-byte-length/-/utf8-byte-length-1.0.4.tgz",
+            "integrity": "sha512-4+wkEYLBbWxqTahEsWrhxepcoVOJ+1z5PGIjPZxRkytcdSUaNjIjBM7Xn8E+pdSuV7SzvWovBFA54FO0JSoqhA=="
+        },
         "utif2": {
             "version": "4.0.1",
             "resolved": "https://registry.npmjs.org/utif2/-/utif2-4.0.1.tgz",
diff --git a/package.json b/package.json
index 0b61e5365..ed8d81d3f 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,8 @@
         "png-chunk-text": "^1.0.0",
         "png-chunks-encode": "^1.0.0",
         "png-chunks-extract": "^1.0.0",
-        "rimraf": "^3.0.2"
+        "rimraf": "^3.0.2",
+        "sanitize-filename": "^1.6.3"
     },
     "name": "TavernAI",
     "version": "1.1.0",
diff --git a/server.js b/server.js
index 29cbae798..7edc3c9b1 100644
--- a/server.js
+++ b/server.js
@@ -14,6 +14,7 @@ const PNGtext = require('png-chunk-text');
 
 const jimp = require('jimp');
 const path = require('path');
+const sanitize = require('sanitize-filename');
 
 const cookieParser = require('cookie-parser');
 const crypto = require('crypto');
@@ -615,6 +616,11 @@ app.post("/deletecharacter", urlencodedParser, function (request, response) {
         return response.sendStatus(400);
     }
 
+    if (request.body.avatar_url !== sanitize(request.body.avatar_url)) {
+        console.error('Malicious filename prevented');
+        return response.sendStatus(400);
+    }
+
     const avatarPath = charactersPath + request.body.avatar_url;
     if (!fs.existsSync(avatarPath)) {
         return response.sendStatus(400);