diff --git a/plinth/modules/backups/forms.py b/plinth/modules/backups/forms.py
index 90f0daa14..88f65d86e 100644
--- a/plinth/modules/backups/forms.py
+++ b/plinth/modules/backups/forms.py
@@ -19,12 +19,16 @@ Forms for backups module.
 """
 
 from django import forms
+from django.core import validators
 from django.utils.translation import ugettext_lazy as _
 
 
 class CreateArchiveForm(forms.Form):
-    name = forms.CharField(label=_('Archive name'), strip=True,
-                           help_text=_('Name for new backup archive.'))
+    name = forms.CharField(
+        label=_('Archive name'), strip=True,
+        help_text=_('Name for new backup archive.'), validators=[
+            validators.RegexValidator(r'^[^/]+$', _('Invalid archive name'))
+        ])
 
     path = forms.CharField(label=_('Path'), strip=True, help_text=_(
         'Disk path to a folder on this server that will be archived into '
diff --git a/plinth/modules/backups/urls.py b/plinth/modules/backups/urls.py
index 53b419419..12b0e578a 100644
--- a/plinth/modules/backups/urls.py
+++ b/plinth/modules/backups/urls.py
@@ -26,10 +26,10 @@ from .views import IndexView, CreateArchiveView, DeleteArchiveView, \
 urlpatterns = [
     url(r'^sys/backups/$', IndexView.as_view(), name='index'),
     url(r'^sys/backups/create/$', CreateArchiveView.as_view(), name='create'),
-    url(r'^sys/backups/(?P<name>[a-z0-9]+)/delete/$',
+    url(r'^sys/backups/(?P<name>[^/]+)/delete/$',
         DeleteArchiveView.as_view(), name='delete'),
-    url(r'^sys/backups/(?P<name>[a-z0-9]+)/extract/$',
+    url(r'^sys/backups/(?P<name>[^/]+)/extract/$',
         ExtractArchiveView.as_view(), name='extract'),
-    url(r'^sys/backups/(?P<name>[a-z0-9]+)/export/$',
+    url(r'^sys/backups/(?P<name>[^/]+)/export/$',
         ExportArchiveView.as_view(), name='export'),
 ]