diff --git a/server/routes/api/attachments.ts b/server/routes/api/attachments.ts
index 76cccd199..8959bf8f6 100644
--- a/server/routes/api/attachments.ts
+++ b/server/routes/api/attachments.ts
@@ -56,7 +56,8 @@ router.post("attachments.create", auth(), async (ctx) => {
   const endpoint = publicS3Endpoint();
   const url = `${endpoint}/${key}`;
 
-  if (documentId) {
+  if (documentId !== undefined) {
+    assertUuid(documentId, "documentId must be a uuid");
     const document = await Document.findByPk(documentId, {
       userId: user.id,
     });