diff --git a/src/Request.php b/src/Request.php
index c6df760..ca7bb3a 100644
--- a/src/Request.php
+++ b/src/Request.php
@@ -235,7 +235,7 @@ public function getRequest(): HttpRequest
      */
     protected function isValidFilename(string $filename): bool
     {
-        $forbidden = ['../', '"', "'", '&', '/', '\\', '?', '#', ':'];
+        $forbidden = Config::get('file.forbidden_characters') ?? ['../', '"', "'", '&', '/', '\\', '?', '#', ':'];
 
         foreach ($forbidden as $char) {
             if (false !== strpos($filename, $char)) {