diff --git a/Install/bin/router.php b/Install/bin/router.php
index 6375667..38ac063 100644
--- a/Install/bin/router.php
+++ b/Install/bin/router.php
@@ -1,31 +1,46 @@
 <?php
 
-[$path] = explode('?', $_SERVER['REQUEST_URI']);
-$basePath = __DIR__ . DIRECTORY_SEPARATOR . '..' . DIRECTORY_SEPARATOR . 'public' . DIRECTORY_SEPARATOR;
-chdir($basePath);
-$path = $basePath . $path;
-if (is_file($path)) {
-    $contentType = mime_content_type($path);
-    if (str_ends_with($path, 'css')) {
-        $contentType = 'text/css';
-    } elseif (str_ends_with($path, 'jpg') || str_ends_with($path, 'jpeg')) {
-        $contentType = 'image/jpeg';
-    } elseif (str_ends_with($path, 'png')) {
-        $contentType = 'image/png';
-    } elseif (str_ends_with($path, 'svg')) {
-        $contentType = 'image/svg+xml';
-    } elseif (str_ends_with($path, 'webp')) {
-        $contentType = 'image/webp';
-    } elseif (str_ends_with($path, 'gif')) {
-        $contentType = 'image/gif';
-    } elseif (str_ends_with($path, 'json')) {
-        $contentType = 'application/json';
-    } elseif (str_ends_with($path, 'js')) {
-        $contentType = 'text/javascript';
+[$requestPath] = explode('?', $_SERVER['REQUEST_URI'], 2);
+
+$basePath = realpath(__DIR__ . '/../public');
+
+if ($basePath === false) {
+    http_response_code(500);
+    exit;
+}
+
+$requestPath = urldecode($requestPath);
+$requestPath = ltrim($requestPath, '/');
+
+$path = realpath($basePath . DIRECTORY_SEPARATOR . $requestPath);
+
+if (
+    $path !== false &&
+    str_starts_with($path, $basePath . DIRECTORY_SEPARATOR) &&
+    is_file($path)
+) {
+    $allowedExtensions = [
+        'css'  => 'text/css',
+        'jpg'  => 'image/jpeg',
+        'jpeg' => 'image/jpeg',
+        'png'  => 'image/png',
+        'svg'  => 'image/svg+xml',
+        'webp' => 'image/webp',
+        'gif'  => 'image/gif',
+        'json' => 'application/json',
+        'js'   => 'text/javascript',
+    ];
+
+    $extension = strtolower(pathinfo($path, PATHINFO_EXTENSION));
+
+    if (!isset($allowedExtensions[$extension])) {
+        http_response_code(403);
+        exit;
     }
 
-    header('Content-type:' . $contentType);
-    echo file_get_contents($path);
-} else {
-    include($basePath . 'index.php');
+    header('Content-Type: ' . $allowedExtensions[$extension]);
+    readfile($path);
+    exit;
 }
+
+include $basePath . DIRECTORY_SEPARATOR . 'index.php';