diff --git a/vendor/magento/module-import-export/Controller/Adminhtml/Export/File/Delete.php b/vendor/magento/module-import-export/Controller/Adminhtml/Export/File/Delete.php
index 00d569c6fedd0..d3b7aebdd40f5 100644
--- a/vendor/magento/module-import-export/Controller/Adminhtml/Export/File/Delete.php
+++ b/vendor/magento/module-import-export/Controller/Adminhtml/Export/File/Delete.php
@@ -11,2 +11,3 @@
 use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Framework\App\ObjectManager;
 use Magento\Framework\Exception\FileSystemException;
@@ -16,6 +17,7 @@
 use Magento\Framework\Filesystem;
 use Magento\Framework\Controller\ResultInterface;
 use Magento\Framework\Filesystem\Directory\WriteFactory;
+use Magento\ImportExport\Model\Export\FileInfo;
 
 /**
  * Controller that delete file by name.
@@ -37,20 +39,28 @@ class Delete extends ExportController implements HttpPostActionInterface
      */
     private $writeFactory;
 
+    /**
+     * @var FileInfo
+     */
+    private $fileInfo;
+
     /**
      * Delete constructor.
      *
      * @param Action\Context $context
      * @param Filesystem $filesystem
      * @param WriteFactory $writeFactory
+     * @param FileInfo|null $fileInfo
      */
     public function __construct(
         Action\Context $context,
         Filesystem $filesystem,
-        WriteFactory $writeFactory
+        WriteFactory $writeFactory,
+        ?FileInfo $fileInfo = null
     ) {
         $this->filesystem = $filesystem;
         $this->writeFactory = $writeFactory;
+        $this->fileInfo = $fileInfo ?? ObjectManager::getInstance()->get(FileInfo::class);
         parent::__construct($context);
     }
 
@@ -72,7 +82,15 @@ public function execute()
             }
             $directoryWrite = $this->filesystem->getDirectoryWrite(DirectoryList::VAR_IMPORT_EXPORT);
             try {
-                $directoryWrite->delete($directoryWrite->getAbsolutePath() . 'export/' . $fileName);
+                $fileName = $directoryWrite->getDriver()->getRealPathSafety(DIRECTORY_SEPARATOR . $fileName);
+                $fileExist = $directoryWrite->isFile('export' . $fileName);
+                if (!$fileExist || !$this->isAllowedExportFile($fileName)) {
+                    $this->messageManager->addErrorMessage(__(
+                        'Sorry, but the data is invalid or the file is not uploaded.'
+                    ));
+                    return $resultRedirect;
+                }
+                $directoryWrite->delete($directoryWrite->getAbsolutePath() . 'export' . $fileName);
                 $this->messageManager->addSuccessMessage(__('File %1 deleted', $fileName));
             } catch (ValidatorException $exception) {
                 $this->messageManager->addErrorMessage(
@@ -89,4 +107,15 @@ public function execute()
 
         return $resultRedirect;
     }
+
+    /**
+     * Check whether requested file is a completed export file.
+     *
+     * @param string $fileName
+     * @return bool
+     */
+    private function isAllowedExportFile(string $fileName): bool
+    {
+        return $this->fileInfo->isExportFile($fileName);
+    }
 }