diff --git a/cli/filelister.cpp b/cli/filelister.cpp
index 9b95689679c..1bc03017e79 100644
--- a/cli/filelister.cpp
+++ b/cli/filelister.cpp
@@ -168,6 +168,10 @@ std::string FileLister::addFiles(std::list<FileWithDetails> &files, const std::s
     if (path.empty())
         return "no path specified";
 
+    const std::string::size_type nulPos = path.find('\0');
+    if (nulPos != std::string::npos)
+        return "path '" + path.substr(0, nulPos) + "' contains a NUL character";
+
     std::list<FileWithDetails> filesSorted;
 
     std::string err = addFiles2(filesSorted, path, extra, recursive, ignored, debug);
@@ -285,6 +289,10 @@ std::string FileLister::addFiles(std::list<FileWithDetails> &files, const std::s
     if (path.empty())
         return "no path specified";
 
+    const std::string::size_type nulPos = path.find('\0');
+    if (nulPos != std::string::npos)
+        return "path '" + path.substr(0, nulPos) + "' contains a NUL character";
+
     std::string corrected_path = path;
     if (endsWith(corrected_path, '/'))
         corrected_path.erase(corrected_path.end() - 1);
diff --git a/test/testfilelister.cpp b/test/testfilelister.cpp
index 13057735513..b90a8cb55e7 100644
--- a/test/testfilelister.cpp
+++ b/test/testfilelister.cpp
@@ -36,6 +36,7 @@ class TestFileLister : public TestFixture {
     void run() override {
         TEST_CASE(recursiveAddFiles);
         TEST_CASE(recursiveAddFilesEmptyPath);
+        TEST_CASE(recursiveAddFilesNulInPath);
         TEST_CASE(excludeFile1);
         TEST_CASE(excludeFile2);
         TEST_CASE(excludeDir);
@@ -110,6 +111,13 @@ class TestFileLister : public TestFixture {
         ASSERT_EQUALS("no path specified", err);
     }
 
+    void recursiveAddFilesNulInPath() const {
+        std::list<FileWithDetails> files;
+        const std::string err = FileLister::recursiveAddFiles(files, std::string("lib\0", 4), {}, PathMatch());
+        ASSERT_EQUALS("path 'lib' contains a NUL character", err);
+        ASSERT(files.empty());
+    }
+
     void excludeFile1() const {
         const std::string basedir = findBaseDir();