diff --git a/routes/fileServer.js b/routes/fileServer.js
index 16e0bd2..70ee03a 100644
--- a/routes/fileServer.js
+++ b/routes/fileServer.js
@@ -1093,7 +1093,19 @@ router.post('*splat', (req, res, next) => {
   } else if (req.query.action === 'create-folder') {
     const newPath = `${req.path}/folders`;
 
-    if (!isLocalUrl(newPath)) {
+    // Only allow strictly relative paths, no path traversal, not protocol-relative, not external host
+    function isSafeRelativePath(path) {
+      // must start with a single "/"
+      if (typeof path !== 'string' || !path.startsWith('/')) return false;
+      // must not contain "//"
+      if (path.includes('//')) return false;
+      // must not contain ".."
+      if (path.includes('..')) return false;
+      // optional: restrict to allowed base directory/prefix
+      return true;
+    }
+
+    if (!isSafeRelativePath(newPath)) {
       logger.warn('Rejected potentially unsafe redirect', { path: newPath });
       return res.status(400).send('Invalid redirect path');
     }