diff --git a/src/buildstream/_cas/cascache.py b/src/buildstream/_cas/cascache.py
index 0db18dd4a..39dfa22da 100644
--- a/src/buildstream/_cas/cascache.py
+++ b/src/buildstream/_cas/cascache.py
@@ -16,6 +16,7 @@
 
 import itertools
 import os
+import re
 import stat
 import contextlib
 import time
@@ -41,6 +42,10 @@
 _CACHE_USAGE_REFRESH = 5
 
 
+# Constant for SHA-256 validation (64 hexadecimal digits)
+_HASH_REGEX = re.compile(r"[0-9a-f]{64}")
+
+
 class CASLogLevel(FastEnum):
     WARNING = "warning"
     INFO = "info"
@@ -323,6 +328,9 @@ def pull_tree(self, remote, digest):
     #     (str): The path of the object
     #
     def objpath(self, digest):
+        if not _HASH_REGEX.fullmatch(digest.hash):
+            raise ValueError(f"Invalid hash: `{digest.hash}`")
+
         return os.path.join(self.casdir, "objects", digest.hash[:2], digest.hash[2:])
 
     # open():