diff --git a/packages/grafana-data/src/text/sanitize.ts b/packages/grafana-data/src/text/sanitize.ts
index 4d22046cb31..2dae143ff69 100644
--- a/packages/grafana-data/src/text/sanitize.ts
+++ b/packages/grafana-data/src/text/sanitize.ts
@@ -156,7 +156,7 @@ export function validatePath<OriginalPath extends string>(path: OriginalPath): O
     }
 
     // Remove query params and fragments to check only the path portion
-    const cleaned = originalDecoded.split(/[\?&#]/)[0];
+    const cleaned = originalDecoded.split(/[\?#]/)[0];
     originalDecoded = cleaned;
 
     // If the original string contains traversal attempts, block it