diff --git a/src-tauri/src/config/profiles.rs b/src-tauri/src/config/profiles.rs
index c6e063893..bfc666546 100644
--- a/src-tauri/src/config/profiles.rs
+++ b/src-tauri/src/config/profiles.rs
@@ -17,6 +17,7 @@ use serde_yaml_ng::Mapping;
 use smartstring::alias::String;
 use std::{
     collections::{HashMap, HashSet},
+    path::{Component, Path},
     sync::{
         LazyLock,
         atomic::{AtomicU64, Ordering},
@@ -227,6 +228,10 @@ impl IProfiles {
 
     /// update the item value
     pub async fn patch_item(&mut self, uid: &String, item: &PrfItem) -> Result<()> {
+        if let Some(file) = &item.file {
+            Self::validate_profile_file(file)?;
+        }
+
         let mut items = self.items.take().unwrap_or_default();
 
         for each in items.iter_mut() {
@@ -250,6 +255,22 @@ impl IProfiles {
         bail!("failed to find the profile item \"uid:{uid}\"")
     }
 
+    fn validate_profile_file(file: &str) -> Result<()> {
+        let mut components = Path::new(file).components();
+        if file.is_empty()
+            || file.contains('/')
+            || file.contains('\\')
+            || !matches!(
+                (components.next(), components.next()),
+                (Some(Component::Normal(_)), None)
+            )
+        {
+            bail!("profile file must be a single filename");
+        }
+
+        Ok(())
+    }
+
     /// be used to update the remote item
     /// only patch `updated` `extra` `file_data`
     pub async fn update_item(&mut self, uid: &String, item: &mut PrfItem) -> Result<()> {