diff --git a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/RepositoryImportResource.java b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/RepositoryImportResource.java
index e3a2763d85..2a0de41d1a 100644
--- a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/RepositoryImportResource.java
+++ b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/RepositoryImportResource.java
@@ -245,7 +245,7 @@ public class RepositoryImportResource {
     )
   )
   public Response importFromBundle(@Context UriInfo uriInfo,
-                                   @PathParam("type") String type,
+                                   @Pattern(regexp = "\\w{1,10}") @PathParam("type") String type,
                                    MultipartFormDataInput input,
                                    @QueryParam("compressed") @DefaultValue("false") boolean compressed) {
     RepositoryPermissions.create().check();