diff --git a/backend/handlers/files.go b/backend/handlers/files.go
index fcee3a3..3684aaa 100644
--- a/backend/handlers/files.go
+++ b/backend/handlers/files.go
@@ -1290,3 +1290,17 @@ func (h *FSHandler) CheckConflicts(c *fiber.Ctx) error {
 
 	return c.JSON(fiber.Map{"conflicts": conflicts})
 }
+
+// safeRemovePath ensures we never delete a base directory.
+func safeRemovePath(baseDir, targetAbsPath string) error {
+	cleanBase := filepath.Clean(baseDir)
+	cleanTarget := filepath.Clean(targetAbsPath)
+	if cleanTarget == cleanBase || cleanTarget == "." || cleanTarget == "/" {
+		return fmt.Errorf("cannot remove base directory %s", baseDir)
+	}
+	// Ensure it's inside the baseDir
+	if !strings.HasPrefix(cleanTarget, cleanBase+string(os.PathSeparator)) {
+		return fmt.Errorf("path escapes base directory")
+	}
+	return os.RemoveAll(cleanTarget)
+}
diff --git a/backend/handlers/onlyoffice.go b/backend/handlers/onlyoffice.go
index f611a23..e06b171 100644
--- a/backend/handlers/onlyoffice.go
+++ b/backend/handlers/onlyoffice.go
@@ -4,7 +4,6 @@ import (
 	"archive/zip"
 	"fmt"
 	"io"
-	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
diff --git a/backend/handlers/webdav.go b/backend/handlers/webdav.go
index a7c9a20..37ca0b1 100644
--- a/backend/handlers/webdav.go
+++ b/backend/handlers/webdav.go
@@ -15,6 +15,7 @@ import (
 
 	"git.elijahkuntz.com/Elijah/drive/config"
 	"git.elijahkuntz.com/Elijah/drive/database"
+	"git.elijahkuntz.com/Elijah/drive/middleware"
 	"github.com/gofiber/fiber/v2"
 	"github.com/valyala/fasthttp/fasthttpadaptor"
 	"golang.org/x/net/webdav"