diff --git a/backend/app/service/file.go b/backend/app/service/file.go
index 84a277848..06745bb60 100644
--- a/backend/app/service/file.go
+++ b/backend/app/service/file.go
@@ -116,6 +116,9 @@ func (f *FileService) GetFileTree(op request.FileOption) ([]response.FileTree, e
 }
 
 func (f *FileService) Create(op request.FileCreate) error {
+	if files.IsInvalidChar(op.Path) {
+		return buserr.New("ErrInvalidChar")
+	}
 	fo := files.NewFileOp()
 	if fo.Stat(op.Path) {
 		return buserr.New(constant.ErrFileIsExit)
@@ -243,6 +246,9 @@ func (f *FileService) SaveContent(edit request.FileEdit) error {
 }
 
 func (f *FileService) ChangeName(req request.FileRename) error {
+	if files.IsInvalidChar(req.NewName) {
+		return buserr.New("ErrInvalidChar")
+	}
 	fo := files.NewFileOp()
 	return fo.Rename(req.OldName, req.NewName)
 }
diff --git a/backend/i18n/lang/en.yaml b/backend/i18n/lang/en.yaml
index 38c1ed9bf..fa087184a 100644
--- a/backend/i18n/lang/en.yaml
+++ b/backend/i18n/lang/en.yaml
@@ -74,6 +74,7 @@ ErrFileDownloadDir: "Download folder not supported"
 ErrCmdNotFound: "{{ .name}} command does not exist, please install this command on the host first"
 ErrSourcePathNotFound:  "Source directory does not exist"
 ErrFavoriteExist: "This path has been collected"
+ErrInvalidChar: "Illegal characters are prohibited"
 
 #website
 ErrDomainIsExist: "Domain is already exist"
diff --git a/backend/i18n/lang/zh-Hant.yaml b/backend/i18n/lang/zh-Hant.yaml
index 90f96b612..3a6f77866 100644
--- a/backend/i18n/lang/zh-Hant.yaml
+++ b/backend/i18n/lang/zh-Hant.yaml
@@ -23,6 +23,7 @@ ErrTypePortRange: '連接埠範圍需要在 1-65535 之間'
 Success: "成功"
 Failed: "失敗"
 SystemRestart: "系統重啟導致任務中斷"
+ErrInvalidChar: "禁止使用非法字元"
 
 #app
 ErrPortInUsed: "{{ .detail }} 端口已被佔用！"
diff --git a/backend/i18n/lang/zh.yaml b/backend/i18n/lang/zh.yaml
index 238ca011c..7f7db7261 100644
--- a/backend/i18n/lang/zh.yaml
+++ b/backend/i18n/lang/zh.yaml
@@ -74,6 +74,7 @@ ErrFileDownloadDir: "不支持下载文件夹"
 ErrCmdNotFound: "{{ .name}} 命令不存在，请先在宿主机安装此命令"
 ErrSourcePathNotFound:  "源目录不存在"
 ErrFavoriteExist: "已收藏此路径"
+ErrInvalidChar: "禁止使用非法字符"
 
 #website
 ErrDomainIsExist: "域名已存在"
diff --git a/backend/utils/files/utils.go b/backend/utils/files/utils.go
index ae2b6c4c2..b72d6198d 100644
--- a/backend/utils/files/utils.go
+++ b/backend/utils/files/utils.go
@@ -10,6 +10,7 @@ import (
 	"os/user"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"sync"
 )
 
@@ -141,3 +142,10 @@ func GetParentMode(path string) (os.FileMode, error) {
 		absPath = parentDir
 	}
 }
+
+func IsInvalidChar(name string) bool {
+	if strings.Contains(name, "&") {
+		return true
+	}
+	return false
+}