diff --git a/changes/3241.fix.md b/changes/3241.fix.md
new file mode 100644
index 00000000000..ee4fd4b6f6f
--- /dev/null
+++ b/changes/3241.fix.md
@@ -0,0 +1 @@
+Prevent vfolder `request-download` API from accessing host filesystem.