1 files changed, 6 insertions, 0 deletions
diff --git a/internal/admin/server.go b/internal/admin/server.go
index 4ea22d8..c13fe96 100644
--- a/internal/admin/server.go
+++ b/internal/admin/server.go
@@ -389,6 +389,12 @@ func (s *AdminServer) checkAuth(r *http.Request) bool {
 		return false
 	}
 	account := parts[0]
+	// The account name is attacker-controlled (it comes from the cookie) and
+	// is joined into players/accounts/<account>.yaml by isAdminAccount below,
+	// so reject path-like names before the first join.
+	if err := player.ValidName(account); err != nil {
+		return false
+	}
 	issued, err := strconv.ParseInt(parts[1], 10, 64)
 	if err != nil {
 		return false