diff --git a/src/PVE/APIServer/AnyEvent.pm b/src/PVE/APIServer/AnyEvent.pm
index 2fa74d2..5cd8afb 100644
--- a/src/PVE/APIServer/AnyEvent.pm
+++ b/src/PVE/APIServer/AnyEvent.pm
@@ -1571,6 +1571,10 @@ sub authenticate_and_handle_request {
 		starttime => [gettimeofday],
 		outfh => $outfh,
 	    };
+
+	    die "'tmpfilename' query parameter is not allowed for file uploads\n"
+		if exists $state->{params}->{tmpfilename};
+
 	    $reqstate->{tmpfilename} = $tmpfilename;
 	    $reqstate->{hdl}->on_read(sub {
 		$self->file_upload_multipart($reqstate, $auth, $method, $path, $state);