chore: additional filename validation

server/src/validation.ts

@@ -100,6 +100,9 @@ export class FilenameParamDto {
   @IsNotEmpty()
   @IsString()
   @ApiProperty({ format: 'string' })
+  @Matches(/^[a-zA-Z0-9_\-\.]+$/, {
+    message: 'Filename contains invalid characters',
+  })
   filename!: string;
 }