diff --git a/console/service/file.go b/console/service/file.go
index 1eb12fb1e..f4a1bdbc7 100644
--- a/console/service/file.go
+++ b/console/service/file.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -23,6 +24,8 @@ import (
 	"github.com/samsarahq/thunder/graphql/schemabuilder"
 )
 
+var volNameRegexp = regexp.MustCompile("^[a-zA-Z0-9][a-zA-Z0-9_.-]{1,61}[a-zA-Z0-9]$")
+
 type FileService struct {
 	userClient *user.UserClient
 	manager    *VolumeManager
@@ -307,6 +310,11 @@ func (fs *FileService) DownFile(writer http.ResponseWriter, request *http.Reques
 		return fmt.Errorf("not found path in get param ?vol_name=[your path]")
 	}
 
+	// check volName
+	if !volNameRegexp.MatchString(volName) {
+		return fmt.Errorf("name can only be number and letters")
+	}
+
 	// author validate
 	if err := fs.userVolPerm(ctx, info.User_id, volName).read(); err != nil {
 		return fmt.Errorf("the user does not have permission to access this volume")