diff --git a/src/API/CustomEmployeeManager.cs b/src/API/CustomEmployeeManager.cs
index 9b4512b6..2cdf57f1 100644
--- a/src/API/CustomEmployeeManager.cs
+++ b/src/API/CustomEmployeeManager.cs
@@ -889,12 +889,20 @@ private static void SetPortrait(Transform card, string employeeId)
             var portraitTransform = card.Find("Image");
             if (portraitTransform == null) return;
 
-            string assetsDir = Path.Combine(MelonEnvironment.UserDataDirectory, "ModAssets");
             string? imagePath = null;
-            foreach (var ext in new[] { ".jpg", ".png" })
+            // [Security] Prevent path traversal bypasses by validating employeeId before file system operations
+            if (employeeId.IndexOfAny(Path.GetInvalidFileNameChars()) >= 0 || employeeId.Contains(".."))
             {
-                string candidate = Path.Combine(assetsDir, employeeId + ext);
-                if (File.Exists(candidate)) { imagePath = candidate; break; }
+                CrashLog.Log($"[Security] SetPortrait: Path traversal detected in employeeId={employeeId}");
+            }
+            else
+            {
+                string assetsDir = Path.Combine(MelonEnvironment.UserDataDirectory, "ModAssets");
+                foreach (var ext in new[] { ".jpg", ".png" })
+                {
+                    string candidate = Path.Combine(assetsDir, employeeId + ext);
+                    if (File.Exists(candidate)) { imagePath = candidate; break; }
+                }
             }
 
             if (imagePath != null)