diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,13 @@
 # Changelog
 
+#### 0.36.0.6
+
+* Security: don't allow newlines in filenames.
+
 #### 0.36.0.5
 
 * Fix documentation for `fileO`.
+* Allow `HUnit 1.3.*`.
 
 #### 0.36.0.4
 
diff --git a/rest-core.cabal b/rest-core.cabal
--- a/rest-core.cabal
+++ b/rest-core.cabal
@@ -1,5 +1,5 @@
 name:                rest-core
-version:             0.36.0.5
+version:             0.36.0.6
 description:         Rest API library.
 synopsis:            Rest API library.
 maintainer:          code@silk.co
@@ -72,7 +72,7 @@
   type:              exitcode-stdio-1.0
   build-depends:
       base >= 4.5 && < 4.9
-    , HUnit == 1.2.*
+    , HUnit >= 1.2 && < 1.4
     , bytestring >= 0.9 && < 0.11
     , mtl >= 2.0 && < 2.3
     , rest-core
diff --git a/src/Rest/Driver/Perform.hs b/src/Rest/Driver/Perform.hs
--- a/src/Rest/Driver/Perform.hs
+++ b/src/Rest/Driver/Perform.hs
@@ -24,7 +24,7 @@
 import Control.Monad.Trans.Maybe (MaybeT (..))
 import Control.Monad.Writer
 import Data.Aeson.Utils
-import Data.Char (isSpace, toLower)
+import Data.Char (isSpace, toLower, ord)
 import Data.List
 import Data.List.Split
 import Data.Maybe
@@ -325,14 +325,18 @@
              setHeader "Content-Type" mime
              setHeader "Cache-Control" "max-age=604800"
              setHeader "Content-Disposition" (  (if isAttachment then "attachment; " else "")
-                                             ++ "filename=\"" ++ escapeQuotes filename ++ "\""
+                                             ++ "filename=\"" ++ headerEscape filename ++ "\""
                                              )
              ok content
         tryD []                t            = unsupportedFormat t
         tryD (_          : xs) t            = tryD xs t
     ok r = setResponseCode 200 >> return r
-    escapeQuotes :: String -> String
-    escapeQuotes = intercalate "\\\"" . splitOn "\""
+    -- Escape double quotes with a backslash, since we quote the
+    -- values with double quotes, and filter out characters below
+    -- space. The latter prevents e.g. newlines ending up in the file
+    -- name, which can cause 'response splitting' security issues.
+    headerEscape :: String -> String
+    headerEscape = filter ((>=32) . ord) . intercalate "\\\"" . splitOn "\""
 
 unsupportedFormat :: (Monad m, Show a) => a -> ExceptT (Last DataError) m a1
 unsupportedFormat = throwError . Last . Just . UnsupportedFormat . show