diff --git a/src/PiPedalModel.cpp b/src/PiPedalModel.cpp
index fd0050e..2b5d8fc 100644
--- a/src/PiPedalModel.cpp
+++ b/src/PiPedalModel.cpp
@@ -31,6 +31,7 @@
 #include "SplitEffect.hpp"
 #include "CpuGovernor.hpp"
 #include "RingBufferReader.hpp"
+#include "PiPedalUI.hpp"
 
 #ifndef NO_MLOCK
 #include <sys/mman.h>
@@ -1735,5 +1736,5 @@ void PiPedalModel::SetSystemMidiBindings(std::vector<MidiBinding> &bindings)
 
 std::vector<std::string> PiPedalModel::GetFileList(const PiPedalFileProperty&fileProperty)
 {
-    return this->storage.GetFileList(PiPedalFilesProperty&fileProperty);    
+    return this->storage.GetFileList(fileProperty);    
 }
diff --git a/src/PiPedalUI.cpp b/src/PiPedalUI.cpp
index 99c0c12..ac27669 100644
--- a/src/PiPedalUI.cpp
+++ b/src/PiPedalUI.cpp
@@ -105,6 +105,10 @@ PiPedalFileProperty::PiPedalFileProperty(PiPedalHost *pHost, const LilvNode *nod
     if (directory)
     {
         this->directory_ = name.AsString();
+        if (!IsDirectoryNameValid(this->directory_))
+        {
+            throw std::logic_error("Pipedal FileProperty::director must have only alpha-numeric characters.");
+        }
     }
     else
     {
@@ -156,6 +160,43 @@ std::vector<PiPedalFileType> PiPedalFileType::GetArray(PiPedalHost*pHost, const
     return result;
 }
 
+bool pipedal::IsAlphaNumeric(const std::string&value)
+{
+    for (char c:value)
+    {
+        if (
+            (c >= '0' && c <= '9')
+            || (c >= 'a' && c <= 'z')
+            || (c >= 'A' && c <= 'Z')
+            || (c == '_')
+
+        ) {
+            continue;
+        }
+        return false;
+
+    }
+    return true;
+}
+
+bool PiPedalFileProperty::IsDirectoryNameValid(const std::string&value)
+{
+    return IsAlphaNumeric(value);
+}
+
+bool PiPedalFileProperty::IsValidExtension(const std::string&extension) const
+{
+
+    for (auto&fileType: fileTypes_)
+    {
+        if (fileType.fileExtension() == extension)
+        {
+            return true;
+        }
+    }
+    return false;
+}
+
 
 JSON_MAP_BEGIN(PiPedalFileType)
     JSON_MAP_REFERENCE(PiPedalFileType,name)
diff --git a/src/PiPedalUI.hpp b/src/PiPedalUI.hpp
index 3f03bdd..ff776fa 100644
--- a/src/PiPedalUI.hpp
+++ b/src/PiPedalUI.hpp
@@ -93,6 +93,9 @@ namespace pipedal {
         const std::vector<PiPedalFileType> &fileTypes() const { return fileTypes_; }
 
         const std::string &patchProperty() const { return patchProperty_; }
+        bool IsValidExtension(const std::string&extension) const;
+        static  bool IsDirectoryNameValid(const std::string&value);
+
     public:
         DECLARE_JSON_MAP(PiPedalFileProperty);
     };
@@ -108,4 +111,9 @@ namespace pipedal {
     private:
         std::vector<PiPedalFileProperty::ptr> fileProperites_;
     };
+
+    // Utiltities for validating file paths received via PiPedalFileProperty-related APIs.
+    bool IsAlphaNumeric(const std::string&value);
+  
+
 };
\ No newline at end of file
diff --git a/src/Storage.cpp b/src/Storage.cpp
index d5f2d95..cd6f68b 100644
--- a/src/Storage.cpp
+++ b/src/Storage.cpp
@@ -1402,39 +1402,35 @@ static bool containsDirectorySeparator(const std::string&value)
     return false;
 }
 
-static bool containsNonAlphaNumericCharacter(const std::string&value)
+
+
+static  void ThrowPermissionDeniedError()
 {
-    for (char c:value)
-    {
-        if (
-            (c >= '0' && c <= '9')
-            || (c >= 'a' && c <= 'z')
-            || (c >= 'A' && c <= 'Z)
-            || (c == '_')
-
-        ) {
-            continue;
-        }
-        return false;
-
-    }
-    return true;
+    throw std::logic_error("Permission denied.");
 }
-
-static void sanityCheckDirectory(const std::string&directory)
-{
-    // we can afford to be highly restrictive here. Alpha-numeric only.
-    if (containsNonAlphaNumericCharacter(directory))
-    {
-        throw std::logic_error("Invalid directory name.");        
-    }
-}
-
 std::vector<std::string> Storage::GetFileList(const PiPedalFileProperty&fileProperty)
 {
-    sanityCheckDirectory(fileProperty.directory());
-    std::filesystem::path path = this->GetAudioFilesDirectory() / fileProperty.directory();
+    if (!PiPedalFileProperty::IsDirectoryNameValid(fileProperty.directory()))
+    {
+        ThrowPermissionDeniedError();
+    }
 
+    std::vector<std::string> result;
+    std::filesystem::path audioFileDirectory = this->GetAudioFilesDirectory() / fileProperty.directory();
+
+    for (auto const&dir_entry: std::filesystem::directory_iterator(audioFileDirectory))
+    {
+        if (dir_entry.is_regular_file())
+        {
+            auto &path = dir_entry.path();
+            if (fileProperty.IsValidExtension(path.extension().string()))
+            {
+                result.push_back(fileProperty.directory() / path.filename());
+            }
+        }
+    }
+
+    return result;
 }
 
 
diff --git a/src/Storage.hpp b/src/Storage.hpp
index 60630c3..9476b2d 100644
--- a/src/Storage.hpp
+++ b/src/Storage.hpp
@@ -68,7 +68,7 @@ private:
     static std::string SafeDecodeName(const std::string& name);
     std::filesystem::path GetPresetsDirectory() const;
     std::filesystem::path GetPluginPresetsDirectory() const;
-    std::filesystem::path GetAudioFilesDirectory() const
+    std::filesystem::path GetAudioFilesDirectory() const;
     std::filesystem::path GetIndexFileName() const;
     std::filesystem::path GetBankFileName(const std::string & name) const;
     std::filesystem::path GetChannelSelectionFileName();