diff --git a/backend/internal/api/logs.go b/backend/internal/api/logs.go
index 675a182..7d05272 100644
--- a/backend/internal/api/logs.go
+++ b/backend/internal/api/logs.go
@@ -170,7 +170,7 @@ func findLatestRPT(dir string) string {
 
 func (h *Handler) GetLog(c *gin.Context) {
 	filename := filepath.Base(c.Param("file"))
-	if filename == "" || strings.ContainsRune(c.Param("file"), os.PathSeparator) {
+	if filename == "" || filename == "." || strings.ContainsAny(filename, "/\\") {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid filename"})
 		return
 	}
diff --git a/backend/internal/api/mods.go b/backend/internal/api/mods.go
index be17a17..e63cef4 100644
--- a/backend/internal/api/mods.go
+++ b/backend/internal/api/mods.go
@@ -2,6 +2,8 @@ package api
 
 import (
 	"net/http"
+	"path/filepath"
+	"strings"
 
 	"arma3-web-server/internal/services"
 
@@ -54,7 +56,18 @@ func (h *Handler) DeleteMod(c *gin.Context) {
 		return
 	}
 
-	if err := services.RemoveMod(input.Path); err != nil {
+	absPath, err := filepath.Abs(input.Path)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid path"})
+		return
+	}
+
+	if !strings.HasPrefix(absPath, h.serverfileDir) && !strings.HasPrefix(absPath, h.modsDir) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "path outside allowed directories"})
+		return
+	}
+
+	if err := services.RemoveMod(absPath); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}