diff --git a/engine/common/http/net_http_xash.c b/engine/common/http/net_http_xash.c
index ba2f32f4..9c79973e 100644
--- a/engine/common/http/net_http_xash.c
+++ b/engine/common/http/net_http_xash.c
@@ -18,7 +18,6 @@ GNU General Public License for more details.
 #include "client.h" // ConnectionProgress
 #include "netchan.h"
 #include "xash3d_mathlib.h"
-#include "ipv6text.h"
 #include "net_ws_private.h"
 #include "miniz.h"
 
@@ -943,6 +942,12 @@ void HTTP_AddDownload( const char *path, int size, qboolean process, resource_t
 {
 	httpfile_t *httpfile;
 
+	if( COM_CheckNastyPath( path ))
+	{
+		Con_Printf( S_ERROR "%s: refused to download %s, nasty path\n", __func__, path );
+		return;
+	}
+
 	if( !http.first_server )
 	{
 		Con_Printf( S_ERROR "no servers to download %s\n", path );
diff --git a/engine/common/net_chan.c b/engine/common/net_chan.c
index 248d8acd..599cce5c 100644
--- a/engine/common/net_chan.c
+++ b/engine/common/net_chan.c
@@ -1233,7 +1233,7 @@ qboolean Netchan_CopyFileFragments( netchan_t *chan, sizebuf_t *msg )
 		Netchan_FlushIncoming( chan, FRAG_FILE_STREAM );
 		return false;
 	}
-	else if( filename[0] != '!' && !COM_IsSafeFileToDownload( filename ))
+	else if( filename[0] != '!' && ( COM_CheckNastyPath( filename ) || !COM_IsSafeFileToDownload( filename )))
 	{
 		Con_Printf( S_ERROR "file fragment received with bad path, ignoring\n" );
 		Netchan_FlushIncoming( chan, FRAG_FILE_STREAM );