diff --git a/backend/internal/servicehost/linux.go b/backend/internal/servicehost/linux.go
index 6fe3125..7c9d3c0 100644
--- a/backend/internal/servicehost/linux.go
+++ b/backend/internal/servicehost/linux.go
@@ -194,7 +194,7 @@ func (e *commandFailure) Error() string {
 func (e *commandFailure) Unwrap() error { return e.err }
 
 func validateName(name string) error {
-	if name == "" || name == "." || name == ".." {
+	if strings.TrimSpace(name) == "" || name == "." || name == ".." || strings.ContainsAny(name, `/\\`) {
 		return ErrInvalidName
 	}
 	return nil
diff --git a/backend/internal/servicehost/service_test.go b/backend/internal/servicehost/service_test.go
index 3285ceb..d7adb1c 100644
--- a/backend/internal/servicehost/service_test.go
+++ b/backend/internal/servicehost/service_test.go
@@ -45,3 +45,11 @@ func TestOptionsNormalizedDefaultsDisplayText(t *testing.T) {
 		t.Fatal("规范化后程序路径不能为空")
 	}
 }
+
+func TestValidateNameRejectsPathLikeValues(t *testing.T) {
+	for _, name := range []string{"", " ", ".", "..", "../Scert", "a/b", `a\b`} {
+		if err := validateName(name); err == nil {
+			t.Errorf("服务名称 %q 未被拒绝", name)
+		}
+	}
+}
diff --git a/backend/internal/servicehost/windows.go b/backend/internal/servicehost/windows.go
index f18a80b..98ec090 100644
--- a/backend/internal/servicehost/windows.go
+++ b/backend/internal/servicehost/windows.go
@@ -6,6 +6,7 @@ import (
 	"context"
 	"os/exec"
 	"strconv"
+	"strings"
 )
 
 func Install(ctx context.Context, options Options) error {
@@ -24,8 +25,8 @@ func Install(ctx context.Context, options Options) error {
 }
 
 func Uninstall(ctx context.Context, name string) error {
-	if name == "" {
-		return commandError("卸载", ErrInvalidName)
+	if err := validateName(name); err != nil {
+		return err
 	}
 	if err := runSC(ctx, "stop", name); err != nil {
 		// 服务未运行时允许继续删除。
@@ -83,7 +84,7 @@ func (e *commandFailure) Error() string {
 func (e *commandFailure) Unwrap() error { return e.err }
 
 func validateName(name string) error {
-	if name == "" || name == "." || name == ".." {
+	if strings.TrimSpace(name) == "" || name == "." || name == ".." || strings.ContainsAny(name, `/\\`) {
 		return ErrInvalidName
 	}
 	return nil