diff --git a/ChangeLog b/ChangeLog
index 0074f23487..588506a6f1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Tue Aug 24 14:32:17 2004  Shugo Maeda  <shugo@ruby-lang.org>
+
+	* lib/cgi/session.rb (CGI::Session::FileStore#initialize): untaint
+	  session id after check.
+
 Tue Aug 24 08:57:51 2004  GOTOU Yuuzou  <gotoyuzo@notwork.org>
 
 	* ext/openssl/ossl_x509attr.c (ossl_x509attr_initialize): d2i
diff --git a/lib/cgi/session.rb b/lib/cgi/session.rb
index 0bc10d013f..a5afb7e3e1 100644
--- a/lib/cgi/session.rb
+++ b/lib/cgi/session.rb
@@ -364,7 +364,7 @@ class CGI
 	unless check_id(id)
 	  raise ArgumentError, "session_id `%s' is invalid" % id
 	end
-	@path = dir+"/"+prefix+id
+	@path = dir+"/"+prefix+id.dup.untaint
 	unless File::exist? @path
 	  @hash = {}
 	end