diff --git a/lib/common.sh b/lib/common.sh
index 68a7a90..2e51504 100644
--- a/lib/common.sh
+++ b/lib/common.sh
@@ -52,13 +52,14 @@ ssr::confirm() {
     [[ "${reply,,}" == "y" ]]
 }
 
-# Validate a path is safe (no traversal, no shell metas). Used before any FS op.
+# Validate a path is safe (no newlines, no `..` traversal). Used before any FS op.
+# Note: bash strings cannot hold NUL bytes, so no separate NUL check needed.
 ssr::validate_path() {
     local p="$1"
     [[ -n "$p" ]] || ssr::die "Empty path"
-    [[ "$p" != *$'\n'* && "$p" != *$'\0'* ]] || ssr::die "Path contains control chars"
     case "$p" in
-        *..*) ssr::die "Path traversal rejected: $p" ;;
+        *$'\n'*) ssr::die "Path contains newline: $p" ;;
+        *..*)    ssr::die "Path traversal rejected: $p" ;;
     esac
 }