1 files changed, 19 insertions, 2 deletions
diff --git a/Emby.Server.Implementations/Library/PathManager.cs b/Emby.Server.Implementations/Library/PathManager.cs
index ef5edb9afa..2a50fcc7fe 100644
--- a/Emby.Server.Implementations/Library/PathManager.cs
+++ b/Emby.Server.Implementations/Library/PathManager.cs
@@ -2,6 +2,7 @@ using System;
 using System.Collections.Generic;
 using System.Globalization;
 using System.IO;
+using Jellyfin.Extensions;
 using MediaBrowser.Common.Configuration;
 using MediaBrowser.Controller.Configuration;
 using MediaBrowser.Controller.Entities;
@@ -43,7 +44,19 @@ public class PathManager : IPathManager
     public string? GetAttachmentPath(string mediaSourceId, string fileName)
     {
         var folder = GetAttachmentFolderPath(mediaSourceId);
-        return folder is null ? null : Path.Combine(folder, fileName);
+        if (folder is null)
+        {
+            return null;
+        }
+
+        var safeName = PathHelper.GetSafeLeafFileName(fileName);
+        if (safeName is null)
+        {
+            _logger.LogWarning("Rejecting attachment filename '{FileName}' for MediaSource {MediaSourceId}: not a valid leaf name.", fileName, mediaSourceId);
+            return null;
+        }
+
+        return Path.Combine(folder, safeName);
     }
 
     /// <inheritdoc />
@@ -121,7 +134,11 @@ public class PathManager : IPathManager
         }
 
         paths.Add(GetTrickplayDirectory(item, false));
-        paths.Add(GetTrickplayDirectory(item, true));
+        if (!string.IsNullOrEmpty(item.Path))
+        {
+            paths.Add(GetTrickplayDirectory(item, true));
+        }
+
         paths.Add(GetChapterImageFolderPath(item));
 
         return paths;