diff --git a/docs/changelog/7.x.x.txt b/docs/changelog/7.x.x.txt
index 25895da56..d81bcf4fb 100644
--- a/docs/changelog/7.x.x.txt
+++ b/docs/changelog/7.x.x.txt
@@ -14,6 +14,7 @@
  - fixed #11772: Metadata in Post doesn't set default value correctly
  - fixed #11768: Edit Branch does not update File wgaccess permissions
  - added Asset Report Asset allowing creation of reports based on Asset Properties.
+ - fixed #11773: Pluggable allows arbitrary module loading
 
 7.9.10
  - fixed #11721: spamStopWords not in WebGUI.conf.original
diff --git a/lib/WebGUI/Pluggable.pm b/lib/WebGUI/Pluggable.pm
index c5608288c..552c1175f 100644
--- a/lib/WebGUI/Pluggable.pm
+++ b/lib/WebGUI/Pluggable.pm
@@ -232,6 +232,11 @@ sub load {
         croak "Could not load $module because $moduleError{$module}";
     }
 
+    # Sanitize
+    if ( $module !~ m{^\w+(?:::\w+)*$} ) {
+        croak "Invalid module name: $module";
+    }
+
     # Try to load the module
     my $modulePath = $module . ".pm";
     $modulePath =~ s{::|'}{/}g;
diff --git a/lib/WebGUI/Storage.pm b/lib/WebGUI/Storage.pm
index 91a5e0f84..c24b51aaa 100644
--- a/lib/WebGUI/Storage.pm
+++ b/lib/WebGUI/Storage.pm
@@ -315,7 +315,7 @@ sub addFileFromFilesystem {
         return undef;
     }
     my $filename = (File::Spec->splitpath( $pathToFile ))[2];
-    if (isIn($self->getFileExtension($filename), qw(pl perl sh cgi php asp))) {
+    if (isIn($self->getFileExtension($filename), qw(pl perl sh cgi php asp pm))) {
         $filename =~ s/\./\_/g;
         $filename .= ".txt";
     }
diff --git a/t/Pluggable.t b/t/Pluggable.t
index 6082ef979..257b23b2f 100644
--- a/t/Pluggable.t
+++ b/t/Pluggable.t
@@ -31,6 +31,7 @@ use Test::Deep::Shallow;
 use Test::Deep::Blessed;
 use Test::Deep::Isa;
 use Test::Deep::Set;
+use Test::Exception;
 
 use WebGUI::Pluggable;
 
@@ -41,7 +42,7 @@ use WebGUI::Pluggable;
 #----------------------------------------------------------------------------
 # Tests
 
-plan tests => 12;        # Increment this number for each test you create
+plan tests => 19;        # Increment this number for each test you create
 
 #----------------------------------------------------------------------------
 # put your tests here
@@ -62,6 +63,15 @@ is($dumper->Dump, q|$VAR1 = {
         };
 |, "Can instanciate an object.");
 
+dies_ok { WebGUI::Pluggable::load( '::HA::HA' ) } 'load dies on bad input';
+like( $@, qr/^\QInvalid module name: ::HA::HA/, 'helpful error message' );
+
+dies_ok { WebGUI::Pluggable::load( 'HA::HA::' ) } 'load dies on bad input';
+dies_ok { WebGUI::Pluggable::load( 'HA::..::..::HA' ) } 'load dies on bad input';
+dies_ok { WebGUI::Pluggable::load( '..::..::..::HA' ) } 'load dies on bad input';
+dies_ok { WebGUI::Pluggable::load( 'uploads::ik::jo::ikjosdfwefsdfsefwef::myfile.txt\0.pm' ) } 'load dies on bad input';
+dies_ok { WebGUI::Pluggable::load( 'HA::::HA' ) } 'load dies on bad input';
+
 #----------------------------------------------------------------------------
 # Test find and findAndLoad
 { # Block to localize @INC