diff --git a/src/becca/entities/bnote.ts b/src/becca/entities/bnote.ts
index b0edd8c61..971055755 100644
--- a/src/becca/entities/bnote.ts
+++ b/src/becca/entities/bnote.ts
@@ -1618,7 +1618,7 @@ class BNote extends AbstractBeccaEntity<BNote> {
      * @param matchBy - choose by which property we detect if to update an existing attachment.
      *                      Supported values are either 'attachmentId' (default) or 'title'
      */
-    saveAttachment({ attachmentId, role, mime, title, content, position }: AttachmentRow, matchBy = "attachmentId") {
+    saveAttachment({ attachmentId, role, mime, title, content, position }: AttachmentRow, matchBy: "attachmentId" | "title" | undefined = "attachmentId") {
         if (!["attachmentId", "title"].includes(matchBy)) {
             throw new Error(`Unsupported value '${matchBy}' for matchBy param, has to be either 'attachmentId' or 'title'.`);
         }
diff --git a/src/routes/api/attachments.ts b/src/routes/api/attachments.ts
index a609b93dc..b0b46db1f 100644
--- a/src/routes/api/attachments.ts
+++ b/src/routes/api/attachments.ts
@@ -33,7 +33,9 @@ function getAllAttachments(req: Request) {
 function saveAttachment(req: Request) {
     const { noteId } = req.params;
     const { attachmentId, role, mime, title, content } = req.body;
-    const { matchBy } = req.query as any;
+    const matchByQuery = req.query.matchBy
+    const isValidMatchBy = (typeof matchByQuery === "string") && (matchByQuery === "attachmentId" || matchByQuery === "title");
+    const matchBy = isValidMatchBy ? matchByQuery : undefined;
 
     const note = becca.getNoteOrThrow(noteId);
     note.saveAttachment({ attachmentId, role, mime, title, content }, matchBy);