diff --git a/src/services/evaluation_service.py b/src/services/evaluation_service.py
index c2dae9e9..89b0a241 100644
--- a/src/services/evaluation_service.py
+++ b/src/services/evaluation_service.py
@@ -767,7 +767,9 @@ class EvaluationService:
     async def get_evaluation_results_by_db(
         self, db_id: str, task_id: str, page: int = 1, page_size: int = 20, error_only: bool = False
     ) -> dict[str, Any]:
-        result_file_path = os.path.join(self._get_result_dir(db_id), f"{task_id}.json")
+        # Prevent path traversal by using basename
+        safe_task_id = os.path.basename(task_id)
+        result_file_path = os.path.join(self._get_result_dir(db_id), f"{safe_task_id}.json")
         if not os.path.exists(result_file_path):
             task = await tasker.get_task(task_id)
             if task:
@@ -833,7 +835,9 @@ class EvaluationService:
         return data
 
     async def delete_evaluation_result_by_db(self, db_id: str, task_id: str) -> None:
-        result_file_path = os.path.join(self._get_result_dir(db_id), f"{task_id}.json")
+        # Prevent path traversal by using basename
+        safe_task_id = os.path.basename(task_id)
+        result_file_path = os.path.join(self._get_result_dir(db_id), f"{safe_task_id}.json")
         if os.path.exists(result_file_path):
             os.remove(result_file_path)
             logger.info(f"成功删除评估结果: {task_id}")