diff --git a/CHANGELOG b/CHANGELOG
index d41450764..b9589785e 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -24,6 +24,7 @@ CHANGELOG Roundcube Webmail
 - Managesieve: Fix possible defect in handling \r\n in scripts (#5685)
 - Fix/rephrase "unsaved changes" warning when cancelling a draft (#5610)
 - Fix XSS issue in handling of a style tag inside of an svg element
+- Fix so settings/upload.inc could not be used by plugins (#5694)
 
 RELEASE 1.3-beta
 ----------------
diff --git a/program/steps/settings/upload.inc b/program/steps/settings/upload.inc
index 0cf7ae60c..5e91f1d20 100644
--- a/program/steps/settings/upload.inc
+++ b/program/steps/settings/upload.inc
@@ -27,6 +27,11 @@ if (!empty($_GET['_progress'])) {
 $from = rcube_utils::get_input_value('_from', rcube_utils::INPUT_GET);
 $type = preg_replace('/(add|edit)-/', '', $from);
 
+// Plugins in Settings may use this file for some uploads (#5694)
+// Make sure it does not contain a dot, which is a special character
+// when using rcube_session::append() below
+$type = str_replace('.', '-', $type);
+
 if ($RCMAIL->action == 'upload-display') {
     $id = 'undefined';