diff --git a/formwork/src/Admin/Controllers/BackupController.php b/formwork/src/Admin/Controllers/BackupController.php
index 6037e7c53..d8e991aee 100644
--- a/formwork/src/Admin/Controllers/BackupController.php
+++ b/formwork/src/Admin/Controllers/BackupController.php
@@ -39,7 +39,7 @@ public function make(): JSONResponse
     public function download(RouteParams $params): Response
     {
         $this->ensurePermission('backup.download');
-        $file = Formwork::instance()->config()->get('backup.path') . base64_decode($params->get('backup'));
+        $file = Formwork::instance()->config()->get('backup.path') . basename(base64_decode($params->get('backup')));
         try {
             if (FileSystem::isFile($file, false)) {
                 return new FileResponse($file, true);