diff --git a/chandler/MVC/Routing/Router.php b/chandler/MVC/Routing/Router.php
index 9d134fb..4e28fbb 100644
--- a/chandler/MVC/Routing/Router.php
+++ b/chandler/MVC/Routing/Router.php
@@ -171,7 +171,7 @@ class Router
             if($_SERVER["HTTP_IF_NONE_MATCH"] === $hash)
                 exit(header("HTTP/1.1 304"));
         
-        header("Content-Type: " . system_extension_mime_type($file));
+        header("Content-Type: " . system_extension_mime_type($file) ?? "text/plain; charset=unknown-8bit");
         header("Content-Size: " . filesize($file));
         header("ETag: $hash");
         
@@ -252,7 +252,8 @@ class Router
     
     function execute(string $url, ?string $parentModule = null): ?string
     {
-        $this->url = parse_url($url, PHP_URL_PATH);
+        $this->url = chandler_escape_url(parse_url($url, PHP_URL_PATH));
+        
         if(!is_null($parentModule)) {
             $GLOBALS["parentModule"]     = $parentModule;
             $this->scope["parentModule"] = $GLOBALS["parentModule"];
diff --git a/chandler/procedural/escape_url.php b/chandler/procedural/escape_url.php
new file mode 100644
index 0000000..ae3b5f0
--- /dev/null
+++ b/chandler/procedural/escape_url.php
@@ -0,0 +1,6 @@
+<?php declare(strict_types=1);
+
+function chandler_escape_url(string $url): string
+{
+    return preg_replace("%\.\.\/|\/\.\.%", "", $url);
+}