diff --git a/routes/tickets.js b/routes/tickets.js
index 24745ad..b9b0c71 100644
--- a/routes/tickets.js
+++ b/routes/tickets.js
@@ -1915,6 +1915,9 @@ router.delete('/articles/:articleId', async (req, res) => {
 router.get('/attachments/:id', async (req, res) => {
   try {
     const { id } = req.params;
+    if (!/^\d+$/.test(id)) {
+      return res.status(404).send('Allegato non trovato.');
+    }
     const result = await pool.query(
       `SELECT filename, content_type, content
        FROM article_data_mime_attachment
@@ -1987,6 +1990,9 @@ router.get('/attachments/:id', async (req, res) => {
 router.put('/attachments/:id', async (req, res) => {
   try {
     const { id } = req.params;
+    if (!/^\d+$/.test(id)) {
+      return res.status(404).json({ error: 'Allegato non trovato' });
+    }
     const { content } = req.body;
     if (typeof content !== 'string') {
       return res.status(400).json({ error: 'Contenuto non valido' });
@@ -2016,6 +2022,9 @@ router.put('/attachments/:id', async (req, res) => {
 router.post('/attachments/:id/open', async (req, res) => {
   try {
     const { id } = req.params;
+    if (!/^\d+$/.test(id)) {
+      return res.status(404).json({ error: 'Allegato non trovato' });
+    }
     const result = await pool.query(
       `SELECT filename, content_type, content FROM article_data_mime_attachment WHERE id = $1`,
       [id]