@@ -42,6 +42,8 @@ File content is served inline only for images (not SVG), video, audio, PDF and `
 
 On-disk names that are not canonical (NFD-normalised, containing control characters, or invalid UTF-8) are skipped in listings. They cannot round-trip through the API's path rules, so showing them would offer entries the user cannot open.
 
+Amended 2026-10-19 (#379): a name containing U+FFFD is treated as invalid UTF-8 and hidden too, so the path rules of a home (`normalizeHomePath`, used by `resolveInRoot` and the local backend) refuse U+FFFD like a control character (`PATH_INVALID` on every write path), and a file request visitor's file or uploader name loses it like a control character. Otherwise any member with write access, or a visitor, could plant files the listing, the ZIP download and the reindex never show. A file whose name contains U+FFFD and was put on the disk outside the app (a restored backup) stays unaddressable, as other non-canonical names do. Cloud sources keep U+FFFD: their listings show such names, so they must stay addressable there; a transfer of one into a home fails that item with `PATH_INVALID`, as a control character does. The web's name dialogs refuse U+FFFD everywhere, a simpler rule than one per source.
+
 ## 2026-10-14: upload content-type gate before body parsing
 
 The upload route checks the content type (`application/octet-stream`) in `onRequest`, before any body parser runs. Otherwise a JSON or text content type would make Fastify buffer the whole body in memory, which is a denial of service.
 
@@ -95,6 +95,24 @@ test('renaming onto a taken name says so in the open dialog; Esc keeps both file
   expect(await download(page, 'b.txt')).toBe('B');
 });
 
+test('a rename to a name with U+FFFD is refused in the dialog and never sent; the list keeps the old name (#379)', async ({ page }, info) => {
+  const dir = `rename-fffd-${tag(info)}`;
+  await setup(page, dir, { 'a.txt': 'A' });
+  const moves: string[] = [];
+  page.on('request', (r) => { if (r.url().includes('/api/v1/sources/home/move')) moves.push(r.url()); });
+  await row(page, 'a.txt').focus();
+  await page.keyboard.press('F2');
+  const input = renameDialog(page).getByRole('textbox');
+  await input.fill('x�.txt');
+  await page.keyboard.press('Enter');
+  await expect(input).toHaveAccessibleDescription(/kein „�“|or “�”/);
+  await expect(input).toHaveAttribute('aria-invalid', 'true');
+  await page.keyboard.press('Escape');
+  await expect(renameDialog(page)).toHaveCount(0);
+  expect(await names(page)).toEqual(['a.txt']);
+  expect(moves).toEqual([]);
+});
+
 test('drag and drop onto a folder moves the item into it', async ({ page }, info) => {
   test.skip(isMobile(info), 'touch has no HTML5 drag and drop; the action menu test covers moving on mobile');
   const dir = `dnd-${tag(info)}`;
 
@@ -73,6 +73,14 @@ test('the name is checked; a taken name says so and keeps the dialog open; Esc c
   await input.fill('a/b');
   await page.keyboard.press('Enter');
   await expect(d).toContainText(/darf nicht leer|can’t be empty/);
+  // #379: U+FFFD is refused here like a control character, before anything is sent.
+  const mkdirs: string[] = [];
+  page.on('request', (r) => { if (r.url().includes('/api/v1/sources/home/mkdir')) mkdirs.push(r.url()); });
+  await input.fill('x�');
+  await page.keyboard.press('Enter');
+  await expect(d).toContainText(/kein „�“|or “�”/);
+  await expect(input).toHaveAttribute('aria-invalid', 'true');
+  expect(mkdirs).toEqual([]);
 
   await input.fill('Ordner');
   await page.keyboard.press('Enter');
 
@@ -21,8 +21,8 @@ const OPEN = '(u.placed_at IS NULL AND (u.upload_id IS NULL OR u.upload_id IN (S
 export const MAX_OPEN_PER_VISITOR = 10;
 export const MAX_OPEN_PER_REQUEST = 100;
 
-// Control characters and bidi marks, as `normalizeUserPath` refuses them; here they are dropped instead.
-const UNSAFE = /[\p{Cc}\p{Bidi_Control}]/gu;
+// Control characters, bidi marks and U+FFFD (#379), as `normalizeHomePath` refuses them; here they are dropped instead.
+const UNSAFE = /[\p{Cc}\p{Bidi_Control}�]/gu;
 const MAX_NAME_BYTES = 255;
 /** The name of an upload whose name has nothing left after sanitising. */
 export const FALLBACK_NAME = 'upload';
 
@@ -7,7 +7,7 @@ import { pipeline } from 'node:stream/promises';
 import type { FastifyBaseLogger } from 'fastify';
 import type { CollisionPolicy, Entry, HomeUsage, LargeFolder, OpenUpload, ThumbSize, TrashItem } from '@files/shared';
 import { AppError } from '../errors.ts';
-import { normalizeUserPath, resolveInRoot } from './resolveInRoot.ts';
+import { normalizeHomePath, resolveInRoot } from './resolveInRoot.ts';
 import { RangeNotSatisfiable, type ByteRange, type Revision, type StorageBackend, type WriteOptions } from './backend.ts';
 import { lookupMime } from './mime.ts';
 import type { Db } from '../db.ts';
@@ -109,10 +109,10 @@ function decodeCursor(cursor: string): SortKey {
   return { d: k.d, n: k.n };
 }
 
-// A listed name must round-trip through normalizeUserPath unchanged, else it could not be addressed again.
+// A listed name must round-trip through normalizeHomePath unchanged, else it could not be addressed again.
 function addressable(name: string): boolean {
   if (name.includes('\uFFFD') || TEMP_NAME.test(name)) return false; // U+FFFD: invalid UTF-8 on disk
-  try { return normalizeUserPath('/' + name) === '/' + name; }
+  try { return normalizeHomePath('/' + name) === '/' + name; }
   catch { return false; } // handled: unaddressable on-disk name is skipped
 }
 
@@ -214,15 +214,15 @@ export class LocalBackend implements StorageBackend {
 
   // Every user path goes through here: normalise, refuse the internal area and temp names, resolve inside the root.
   private async abs(p: string) {
-    const n = normalizeUserPath(p);
+    const n = normalizeHomePath(p);
     if (n === `/${INTERNAL}` || n.startsWith(`/${INTERNAL}/`)) throw new AppError('PATH_INVALID');
     if (n !== '/' && TEMP_NAME.test(basename(n))) throw new AppError('PATH_INVALID');
     await mkdir(this.root, { recursive: true });
     return resolveInRoot(this.root, n);
   }
 
   private entry(userPath: string, st: { isDirectory(): boolean; size: number; mtime: Date }): Entry {
-    const path = normalizeUserPath(userPath);
+    const path = normalizeHomePath(userPath);
     const name = path === '/' ? '/' : basename(path);
     const isDir = st.isDirectory();
     return { name, path, type: isDir ? 'directory' : 'file', size: isDir ? 0 : st.size,
@@ -255,14 +255,14 @@ export class LocalBackend implements StorageBackend {
 
   /** The kept versions of a file (#154), oldest first; the file itself is not one of them. */
   async revisions(p: string): Promise<Revision[]> {
-    const n = normalizeUserPath(p);
+    const n = normalizeHomePath(p);
     await this.statFile(n);
     return this.liveVersions(n).map((v) => ({ id: v.id, modified: v.modified, size: v.size }));
   }
 
   /** The bytes of one kept version of the file at `p`; a version of any other file is NOT_FOUND. */
   async readRevision(p: string, id: string): Promise<Awaited<ReturnType<StorageBackend['read']>>> {
-    const n = normalizeUserPath(p);
+    const n = normalizeHomePath(p);
     await this.abs(n);
     const row = this.versionRow(n, id);
     if (!row) throw new AppError('NOT_FOUND');
@@ -288,7 +288,7 @@ export class LocalBackend implements StorageBackend {
   restoreRevision(p: string, id: string): Promise<Entry> { return this.restoreRevisionImpl(p, id).catch(rethrowMapped); }
 
   private async restoreRevisionImpl(p: string, id: string): Promise<Entry> {
-    const n = normalizeUserPath(p);
+    const n = normalizeHomePath(p);
     const target = await this.abs(n);
     if (!this.versionRow(n, id)) throw new AppError('NOT_FOUND');
     await this.statFile(n);
@@ -365,7 +365,7 @@ export class LocalBackend implements StorageBackend {
     const st = await lstat(a).then((s) => s, (e) => { if (isErr(e, 'ENOENT')) throw new AppError('NOT_FOUND'); throw e; });
     if (st.isDirectory()) throw new AppError('IS_A_DIRECTORY');
     if (!st.isFile()) throw new AppError('NOT_FOUND');
-    return thumbs.get({ userId, path: normalizeUserPath(p), abs: a, etag: etagOf(this.index.etagKey, st), mime: lookupMime(basename(a)) }, size);
+    return thumbs.get({ userId, path: normalizeHomePath(p), abs: a, etag: etagOf(this.index.etagKey, st), mime: lookupMime(basename(a)) }, size);
   }
 
   // After a write, move or delete has landed: the thumbnails of the paths it touched (and beneath them) go. A stale one
@@ -418,7 +418,7 @@ export class LocalBackend implements StorageBackend {
   }
 
   private async endpoints(from: string, to: string, policy: CollisionPolicy) {
-    const nf = normalizeUserPath(from); const nt = normalizeUserPath(to);
+    const nf = normalizeHomePath(from); const nt = normalizeHomePath(to);
     if (nf === '/' || nt === '/') throw new AppError('PATH_INVALID');
     const src = await this.abs(nf); const dst = await this.abs(nt);
     const st = await lstat(src).then((s) => s, (e) => { if (isErr(e, 'ENOENT')) throw new AppError('NOT_FOUND'); throw e; });
@@ -521,7 +521,7 @@ export class LocalBackend implements StorageBackend {
 
   private async deleteImpl(paths: readonly string[]): Promise<void> {
     if (paths.length === 0) throw new AppError('VALIDATION');
-    const norm = [...new Set(paths.map(normalizeUserPath))];
+    const norm = [...new Set(paths.map(normalizeHomePath))];
     if (norm.includes('/')) throw new AppError('PATH_INVALID');
     // An item beneath another selected one goes to the trash with it.
     const top = norm.filter((p) => !norm.some((q) => p.startsWith(q + '/')));
@@ -583,7 +583,7 @@ export class LocalBackend implements StorageBackend {
     if (this.index.disk && row.size > await this.index.disk.left()) throw new AppError('STORAGE_FULL');
     const src = await this.trashBytes(id);
     const trash = await this.internalDir('trash');
-    const nt = normalizeUserPath(row.original_path);
+    const nt = normalizeHomePath(row.original_path);
     const dst = await this.abs(nt); // refuses symlinks and files on the way, like any user path
     await mkdir(dirname(dst), { recursive: true }).catch((e) => {
       if (isErr(e, 'ENOTDIR') || isErr(e, 'EEXIST')) throw new AppError('NOT_A_DIRECTORY', undefined, { cause: e });
@@ -775,7 +775,7 @@ export class LocalBackend implements StorageBackend {
 
   private async createUploadImpl(u: CreateUpload) {
     if (u.length > u.maxBytes) throw new AppError('PAYLOAD_TOO_LARGE');
-    const nt = normalizeUserPath(u.path);
+    const nt = normalizeHomePath(u.path);
     if (nt === '/') throw new AppError('PATH_INVALID');
     // An upload for another source (a file request into a cloud folder) is only staged here: its path is not in this home.
     if (u.source === 'home') {
@@ -957,7 +957,7 @@ export class LocalBackend implements StorageBackend {
   private async placeUpload(row: UploadRow, policy: CollisionPolicy, onPlaced?: (name: string) => void): Promise<Entry> {
     // Staged for another source: only its caller's `UploadPlacement` places it (a file request into a cloud folder).
     if (row.source !== 'home' && !onPlaced) throw new AppError('NOT_SUPPORTED');
-    const nt = normalizeUserPath(row.path);
+    const nt = normalizeHomePath(row.path);
     const target = await this.abs(nt);
     await mkdir(dirname(target), { recursive: true }).catch((e) => {
       if (isErr(e, 'ENOTDIR') || isErr(e, 'EEXIST')) throw new AppError('NOT_A_DIRECTORY', undefined, { cause: e });
@@ -1003,7 +1003,7 @@ export class LocalBackend implements StorageBackend {
       if (isErr(e, 'ENOTDIR')) throw new AppError('NOT_A_DIRECTORY');
       throw e;
     }
-    const base = normalizeUserPath(p);
+    const base = normalizeHomePath(p);
     const keyed = dirents
       .filter((d) => !(base === '/' && d.name === INTERNAL) && (d.isFile() || d.isDirectory()) && addressable(d.name))
       .map((d) => ({ d, key: { d: d.isDirectory() ? 1 : 0, n: d.name } as SortKey }))
@@ -1053,7 +1053,7 @@ export class LocalBackend implements StorageBackend {
     const a = await this.abs(p);
     await mkdir(dirname(a), { recursive: true });
     await mkdir(a).catch((e) => { if (isErr(e, 'EEXIST')) throw new AppError('FILE_EXISTS'); throw e; });
-    this.index.db.transaction(() => this.indexPlaced(normalizeUserPath(p), a)).immediate();
+    this.index.db.transaction(() => this.indexPlaced(normalizeHomePath(p), a)).immediate();
     return this.statImpl(p);
   }
 
@@ -1113,7 +1113,7 @@ export class LocalBackend implements StorageBackend {
       let rel: string;
       if (opts.onCollision === 'replace') {
         // The content being replaced is kept as a version, in the transaction that puts the new bytes in place.
-        rel = normalizeUserPath(p);
+        rel = normalizeHomePath(p);
         const versions = await this.internalDir('versions');
         this.atomically((fs) => {
           this.keepVersion(fs, versions, target, rel);
@@ -1127,7 +1127,7 @@ export class LocalBackend implements StorageBackend {
       } else {
         const finalPath = await this.place(tmp, target, opts.onCollision);
         await syncDir(dir);
-        rel = join(dirname(normalizeUserPath(p)), basename(finalPath));
+        rel = join(dirname(normalizeHomePath(p)), basename(finalPath));
         db.transaction(() => { recordRecent(db, userId, rel, 'file'); this.indexPlaced(rel, finalPath); }).immediate();
       }
       await this.forgetThumbs(rel);
 
@@ -18,8 +18,18 @@ export function normalizeUserPath(userPath: string): string {
   return '/' + segments.join('/');
 }
 
+/**
+ * `normalizeUserPath` for a path in a home on disk, which also refuses U+FFFD (#379): a home listing hides names holding
+ * it (invalid UTF-8 on disk, storage/local.ts `addressable`), so no path in a home may contain it and no write creates
+ * one. Cloud sources list such names and still address them through `normalizeUserPath`.
+ */
+export function normalizeHomePath(userPath: string): string {
+  if (typeof userPath === 'string' && userPath.includes('�')) throw new AppError('PATH_INVALID');
+  return normalizeUserPath(userPath);
+}
+
 export async function resolveInRoot(root: string, userPath: string): Promise<string> {
-  const normalized = normalizeUserPath(userPath);
+  const normalized = normalizeHomePath(userPath);
   const realRoot = await realpath(root);
   const segments = normalized.split('/').filter(Boolean);
   if (Buffer.byteLength(join(realRoot, ...segments)) > MAX_PATH_BYTES) throw new AppError('PATH_INVALID');
 
@@ -196,6 +196,17 @@ describe('the visitor', () => {
     expect((await files(r.id)).map((f) => f.name).sort()).toEqual(['not-there.pdf', 'secret-contract (1).pdf']);
   });
 
+  it('a visitor\'s name loses U+FFFD like a control character, so the file appears in the owner\'s listing (#379)', async () => {
+    const dir = await folder();
+    const r = await request(dir, { askName: true });
+    const v = await visitor(r.token);
+    expect((await upload(r.token, v, 'invoice�.pdf', 'pdf', { uploader: 'Test� User' })).statusCode).toBe(204);
+    expect(namesIn(dir)).toEqual(['invoice.pdf']);
+    const listed = await ok(t.app.inject({ url: `/api/v1/sources/home/list?path=${encodeURIComponent(dir)}`, headers: { cookie: owner.cookie } }));
+    expect((listed.json().entries as Entry[]).map((e) => e.name)).toEqual(['invoice.pdf']);
+    expect((await files(r.id)).map((f) => [f.name, f.uploader])).toEqual([['invoice.pdf', 'Test User']]);
+  });
+
   it('names are sanitised and never leave the target folder (#94); colliding names are all kept', async () => {
     const parent = await folder();
     await ok(op('mkdir', { path: `${parent}/inbox` }));
 
@@ -0,0 +1,74 @@
+import { existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { homeRoot } from '../src/paths.ts';
+import { startTestApp, login, type TestApp } from './support/harness.ts';
+import { basic, createAppPassword } from './support/dav.ts';
+
+// #379: a listing hides names containing U+FFFD (they stand for invalid UTF-8 on disk), so no write path may create one:
+// otherwise a file request visitor or a member with `edit` plants files the owner never sees.
+
+type S = { cookie: string; csrf: string };
+let t: TestApp; let a: S; let pw: string; let root: string;
+const ORIGIN = 'https://files.example.com';
+const mutating = (s: S) => ({ cookie: s.cookie, 'x-csrf-token': s.csrf, origin: ORIGIN });
+
+beforeAll(async () => {
+  t = await startTestApp();
+  a = await login(t, 'testuser');
+  pw = await createAppPassword(t, a);
+  root = homeRoot(t.config.dataDir, (await t.app.inject({ url: '/api/v1/me', headers: { cookie: a.cookie } })).json().id);
+});
+afterAll(() => t.close());
+
+const op = (name: string, payload: object) => t.app.inject({
+  method: 'POST', url: `/api/v1/sources/home/${name}`, headers: mutating(a), payload });
+const put = (path: string, text: string) => t.app.inject({
+  method: 'PUT', url: `/api/v1/sources/home/content?path=${encodeURIComponent(path)}&onCollision=fail`,
+  headers: { ...mutating(a), 'content-type': 'application/octet-stream' }, payload: Buffer.from(text) });
+const list = async (path: string) => {
+  const r = await t.app.inject({ url: `/api/v1/sources/home/list?path=${encodeURIComponent(path)}`, headers: { cookie: a.cookie } });
+  expect(r.statusCode, r.body).toBe(200);
+  return (r.json().entries as { name: string }[]).map((e) => e.name).sort();
+};
+
+describe('names containing U+FFFD are refused on every write path (#379)', () => {
+  it('PUT, mkdir, move and copy answer PATH_INVALID and create nothing; the listing shows what exists', async () => {
+    expect((await op('mkdir', { path: '/probe' })).statusCode).toBe(201);
+    const p = await put('/probe/report�.txt', 'hidden');
+    expect(p.statusCode, p.body).toBe(400);
+    expect(p.json()).toEqual({ code: 'PATH_INVALID' });
+    expect(existsSync(join(root, 'probe', 'report�.txt'))).toBe(false);
+
+    const d = await op('mkdir', { path: '/probe/dir�' });
+    expect(d.statusCode, d.body).toBe(400);
+    expect(d.json()).toEqual({ code: 'PATH_INVALID' });
+
+    expect((await put('/probe/a.txt', 'a')).statusCode).toBe(201);
+    const m = await op('move', { from: '/probe/a.txt', to: '/probe/b�.txt', onCollision: 'fail' });
+    expect(m.statusCode, m.body).toBe(400);
+    expect(m.json()).toEqual({ code: 'PATH_INVALID' });
+    const c = await op('copy', { from: '/probe/a.txt', to: '/probe/c�.txt', onCollision: 'fail' });
+    expect(c.statusCode, c.body).toBe(400);
+    expect(c.json()).toEqual({ code: 'PATH_INVALID' });
+
+    // Nothing hidden was planted: the disk holds exactly what the listing shows.
+    expect(readdirSync(join(root, 'probe'))).toEqual(['a.txt']);
+    expect(await list('/probe')).toEqual(['a.txt']);
+  });
+
+  it('WebDAV PUT and MOVE to such a name answer 400 and create nothing', async () => {
+    const dav = (method: string, path: string, headers: Record<string, string> = {}, payload?: string) => t.app.inject({
+      method: method as 'PUT', url: `/dav${path}`, payload, headers: { authorization: basic(pw), ...headers } });
+    expect((await dav('MKCOL', '/davprobe')).statusCode).toBe(201);
+    const p = await dav('PUT', '/davprobe/%EF%BF%BD.txt', {}, 'hidden');
+    expect(p.statusCode, p.body).toBe(400);
+    expect(existsSync(join(root, 'davprobe', '�.txt'))).toBe(false);
+
+    expect((await dav('PUT', '/davprobe/a.txt', {}, 'a')).statusCode).toBe(201);
+    const m = await dav('MOVE', '/davprobe/a.txt', { destination: `${ORIGIN}/dav/davprobe/b%EF%BF%BD.txt` });
+    expect(m.statusCode, m.body).toBe(400);
+    expect(readdirSync(join(root, 'davprobe'))).toEqual(['a.txt']);
+    expect(await list('/davprobe')).toEqual(['a.txt']);
+  });
+});