diff --git a/C4/Templates.pm b/C4/Templates.pm
index 10d028334a..17746e85cf 100644
--- a/C4/Templates.pm
+++ b/C4/Templates.pm
@@ -171,6 +171,7 @@ sub _get_template_file {
 sub gettemplate {
     my ( $tmplbase, $interface, $query, $is_plugin ) = @_;
     ($query) or warn "no query in gettemplate";
+    die "bad template path" unless $tmplbase =~ m/^[a-zA-Z0-9_\-\/]+\.(tt|pref)$/; # Will be extended on bug 17989
     my $path = C4::Context->preference('intranet_includes') || 'includes';
     my ($htdocs, $theme, $lang, $filename)
        =  _get_template_file($tmplbase, $interface, $query);