diff --git a/controller/internal/storage/attach_linux.go b/controller/internal/storage/attach_linux.go
index 3e54a25..96dd0d9 100644
--- a/controller/internal/storage/attach_linux.go
+++ b/controller/internal/storage/attach_linux.go
@@ -148,7 +148,7 @@ func CreateDirectory(basePath, name string) (string, error) {
 	// Check if already exists
 	if fi, err := os.Stat(targetPath); err == nil {
 		if fi.IsDir() {
-			return targetPath, nil // already exists, idempotent
+			return "", fmt.Errorf("a mappa már létezik: %s", name)
 		}
 		return "", fmt.Errorf("a cél már létezik és nem mappa")
 	}
diff --git a/controller/internal/web/templates/storage_attach.html b/controller/internal/web/templates/storage_attach.html
index 4785de6..05c40fc 100644
--- a/controller/internal/web/templates/storage_attach.html
+++ b/controller/internal/web/templates/storage_attach.html
@@ -393,6 +393,18 @@ function createDir() {
     var errEl = document.getElementById('browse-error');
     errEl.style.display = 'none';
 
+    // Client-side validation
+    if (!/^[a-zA-Z0-9_]+$/.test(name)) {
+        errEl.textContent = 'A mappanéven csak betűk, számok és alávonás megengedett.';
+        errEl.style.display = 'block';
+        return;
+    }
+    if (name.length > 32) {
+        errEl.textContent = 'A mappanév legfeljebb 32 karakter lehet.';
+        errEl.style.display = 'block';
+        return;
+    }
+
     fetch('/api/storage/attach/mkdir', {
         method: 'POST',
         headers: {'Content-Type': 'application/json'},