diff --git a/router/router_transfer.go b/router/router_transfer.go
index 3cf27f77..e1837316 100644
--- a/router/router_transfer.go
+++ b/router/router_transfer.go
@@ -263,7 +263,9 @@ out:
 				trnsfr.Log().WithField("path", installLogPath).Debug("install logs saved successfully")
 
 			case strings.HasPrefix(name, "backup_"):
-				backupName := strings.TrimPrefix(name, "backup_")
+				backupNameUnsafe := strings.TrimPrefix(name, "backup_")
+				// Strip all directory components
+				backupName := filepath.Base(backupNameUnsafe)
 				trnsfr.Log().WithField("backup", backupName).Debug("received backup file")
 
 				// Create backup directory if it doesn't exist