diff --git a/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/FeedbackRestRepository.java b/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/FeedbackRestRepository.java
index 8fd28bbe94..8188237114 100644
--- a/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/FeedbackRestRepository.java
+++ b/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/FeedbackRestRepository.java
@@ -79,8 +79,14 @@ public class FeedbackRestRepository extends DSpaceRestRepository<FeedbackRest, I
             throw new DSpaceBadRequestException("e-mail and message fields are mandatory!");
         }
 
+        String pageUrl = feedbackRest.getPage();
+        String urlPrefix = configurationService.getProperty("dspace.ui.url");
+        if (! StringUtils.startsWith(pageUrl, urlPrefix)) {
+            throw new DSpaceBadRequestException("unexpected page url was submitted");
+        }
+
         try {
-            feedbackService.sendEmail(context, req, recipientEmail, senderEmail, message, feedbackRest.getPage());
+            feedbackService.sendEmail(context, req, recipientEmail, senderEmail, message, pageUrl);
         } catch (IOException | MessagingException e) {
             throw new RuntimeException(e.getMessage(), e);
         }
@@ -100,4 +106,4 @@ public class FeedbackRestRepository extends DSpaceRestRepository<FeedbackRest, I
         this.feedbackService = feedbackService;
     }
 
-}
\ No newline at end of file
+}