diff --git a/src/main/java/org/cbioportal/application/file/model/CancerStudyMetadata.java b/src/main/java/org/cbioportal/application/file/model/CancerStudyMetadata.java
index 1986c1df1e6..01ea18480a8 100644
--- a/src/main/java/org/cbioportal/application/file/model/CancerStudyMetadata.java
+++ b/src/main/java/org/cbioportal/application/file/model/CancerStudyMetadata.java
@@ -1,5 +1,6 @@
 package org.cbioportal.application.file.model;
 
+import jakarta.validation.constraints.Pattern;
 import java.util.SequencedMap;
 
 /** Represents metadata for a cancer study. */
@@ -13,8 +14,12 @@ public class CancerStudyMetadata implements StudyRelatedMetadata {
 
   /**
    * A string used to uniquely identify this cancer study within the database, e.g.,
-   * "brca_joneslab_2013".
+   * "brca_joneslab_2013". Can only contain alphanumeric characters, underscores, and hyphens.
    */
+  @Pattern(
+      regexp = "^[a-zA-Z0-9_-]+$",
+      message =
+          "Cancer study identifier can only contain alphanumeric characters, underscores, and hyphens")
   private String cancerStudyIdentifier;
 
   /** The name of the cancer study, e.g., "Breast Cancer (Jones Lab 2013)". */
diff --git a/src/main/java/org/cbioportal/legacy/model/CancerStudy.java b/src/main/java/org/cbioportal/legacy/model/CancerStudy.java
index ff0ace593f0..352d1a32ba6 100644
--- a/src/main/java/org/cbioportal/legacy/model/CancerStudy.java
+++ b/src/main/java/org/cbioportal/legacy/model/CancerStudy.java
@@ -1,13 +1,21 @@
 package org.cbioportal.legacy.model;
 
 import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Pattern;
 import java.io.Serializable;
 import java.util.Date;
 
 public class CancerStudy implements ReadPermission, Serializable {
 
   private Integer cancerStudyId;
-  @NotNull private String cancerStudyIdentifier;
+
+  @NotNull
+  @Pattern(
+      regexp = "^[a-zA-Z0-9_-]+$",
+      message =
+          "Cancer study identifier can only contain alphanumeric characters, underscores, and hyphens")
+  private String cancerStudyIdentifier;
+
   private String typeOfCancerId;
   private String name;
   private String description;
diff --git a/src/test/java/org/cbioportal/application/file/model/CancerStudyMetadataValidationTest.java b/src/test/java/org/cbioportal/application/file/model/CancerStudyMetadataValidationTest.java
new file mode 100644
index 00000000000..e43131c788f
--- /dev/null
+++ b/src/test/java/org/cbioportal/application/file/model/CancerStudyMetadataValidationTest.java
@@ -0,0 +1,100 @@
+package org.cbioportal.application.file.model;
+
+import jakarta.validation.ConstraintViolation;
+import jakarta.validation.Validation;
+import jakarta.validation.Validator;
+import jakarta.validation.ValidatorFactory;
+import java.util.Set;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+
+public class CancerStudyMetadataValidationTest {
+
+  private Validator validator;
+
+  @Before
+  public void setUp() {
+    ValidatorFactory factory = Validation.buildDefaultValidatorFactory();
+    validator = factory.getValidator();
+  }
+
+  @Test
+  public void testValidStudyIdentifierWithAlphanumeric() {
+    CancerStudyMetadata metadata = new CancerStudyMetadata();
+    metadata.setCancerStudyIdentifier("study123");
+
+    Set<ConstraintViolation<CancerStudyMetadata>> violations = validator.validate(metadata);
+    Assert.assertTrue(
+        "Study identifier with alphanumeric characters should be valid", violations.isEmpty());
+  }
+
+  @Test
+  public void testValidStudyIdentifierWithUnderscore() {
+    CancerStudyMetadata metadata = new CancerStudyMetadata();
+    metadata.setCancerStudyIdentifier("study_es_0");
+
+    Set<ConstraintViolation<CancerStudyMetadata>> violations = validator.validate(metadata);
+    Assert.assertTrue("Study identifier with underscores should be valid", violations.isEmpty());
+  }
+
+  @Test
+  public void testValidStudyIdentifierWithHyphen() {
+    CancerStudyMetadata metadata = new CancerStudyMetadata();
+    metadata.setCancerStudyIdentifier("study-es-0");
+
+    Set<ConstraintViolation<CancerStudyMetadata>> violations = validator.validate(metadata);
+    Assert.assertTrue("Study identifier with hyphens should be valid", violations.isEmpty());
+  }
+
+  @Test
+  public void testValidStudyIdentifierWithMixedCharacters() {
+    CancerStudyMetadata metadata = new CancerStudyMetadata();
+    metadata.setCancerStudyIdentifier("Study_123-ABC");
+
+    Set<ConstraintViolation<CancerStudyMetadata>> violations = validator.validate(metadata);
+    Assert.assertTrue(
+        "Study identifier with mixed valid characters should be valid", violations.isEmpty());
+  }
+
+  @Test
+  public void testInvalidStudyIdentifierWithPlus() {
+    CancerStudyMetadata metadata = new CancerStudyMetadata();
+    metadata.setCancerStudyIdentifier("study+es+0");
+
+    Set<ConstraintViolation<CancerStudyMetadata>> violations = validator.validate(metadata);
+    Assert.assertFalse("Study identifier with plus signs should be invalid", violations.isEmpty());
+    Assert.assertTrue(
+        "Error message should mention allowed characters",
+        violations.iterator().next().getMessage().contains("alphanumeric"));
+  }
+
+  @Test
+  public void testInvalidStudyIdentifierWithSpace() {
+    CancerStudyMetadata metadata = new CancerStudyMetadata();
+    metadata.setCancerStudyIdentifier("study es 0");
+
+    Set<ConstraintViolation<CancerStudyMetadata>> violations = validator.validate(metadata);
+    Assert.assertFalse("Study identifier with spaces should be invalid", violations.isEmpty());
+  }
+
+  @Test
+  public void testInvalidStudyIdentifierWithSpecialCharacters() {
+    CancerStudyMetadata metadata = new CancerStudyMetadata();
+    metadata.setCancerStudyIdentifier("study@es#0");
+
+    Set<ConstraintViolation<CancerStudyMetadata>> violations = validator.validate(metadata);
+    Assert.assertFalse(
+        "Study identifier with special characters should be invalid", violations.isEmpty());
+  }
+
+  @Test
+  public void testInvalidStudyIdentifierWithPercent() {
+    CancerStudyMetadata metadata = new CancerStudyMetadata();
+    metadata.setCancerStudyIdentifier("study%20");
+
+    Set<ConstraintViolation<CancerStudyMetadata>> violations = validator.validate(metadata);
+    Assert.assertFalse(
+        "Study identifier with percent encoding should be invalid", violations.isEmpty());
+  }
+}
diff --git a/src/test/java/org/cbioportal/legacy/model/CancerStudyValidationTest.java b/src/test/java/org/cbioportal/legacy/model/CancerStudyValidationTest.java
new file mode 100644
index 00000000000..79d885935d6
--- /dev/null
+++ b/src/test/java/org/cbioportal/legacy/model/CancerStudyValidationTest.java
@@ -0,0 +1,109 @@
+package org.cbioportal.legacy.model;
+
+import jakarta.validation.ConstraintViolation;
+import jakarta.validation.Validation;
+import jakarta.validation.Validator;
+import jakarta.validation.ValidatorFactory;
+import java.util.Set;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+
+public class CancerStudyValidationTest {
+
+  private Validator validator;
+
+  @Before
+  public void setUp() {
+    ValidatorFactory factory = Validation.buildDefaultValidatorFactory();
+    validator = factory.getValidator();
+  }
+
+  @Test
+  public void testValidStudyIdentifierWithAlphanumeric() {
+    CancerStudy cancerStudy = new CancerStudy();
+    cancerStudy.setCancerStudyIdentifier("study123");
+
+    Set<ConstraintViolation<CancerStudy>> violations = validator.validate(cancerStudy);
+    Assert.assertTrue(
+        "Study identifier with alphanumeric characters should be valid", violations.isEmpty());
+  }
+
+  @Test
+  public void testValidStudyIdentifierWithUnderscore() {
+    CancerStudy cancerStudy = new CancerStudy();
+    cancerStudy.setCancerStudyIdentifier("study_es_0");
+
+    Set<ConstraintViolation<CancerStudy>> violations = validator.validate(cancerStudy);
+    Assert.assertTrue("Study identifier with underscores should be valid", violations.isEmpty());
+  }
+
+  @Test
+  public void testValidStudyIdentifierWithHyphen() {
+    CancerStudy cancerStudy = new CancerStudy();
+    cancerStudy.setCancerStudyIdentifier("study-es-0");
+
+    Set<ConstraintViolation<CancerStudy>> violations = validator.validate(cancerStudy);
+    Assert.assertTrue("Study identifier with hyphens should be valid", violations.isEmpty());
+  }
+
+  @Test
+  public void testValidStudyIdentifierWithMixedCharacters() {
+    CancerStudy cancerStudy = new CancerStudy();
+    cancerStudy.setCancerStudyIdentifier("Study_123-ABC");
+
+    Set<ConstraintViolation<CancerStudy>> violations = validator.validate(cancerStudy);
+    Assert.assertTrue(
+        "Study identifier with mixed valid characters should be valid", violations.isEmpty());
+  }
+
+  @Test
+  public void testInvalidStudyIdentifierWithPlus() {
+    CancerStudy cancerStudy = new CancerStudy();
+    cancerStudy.setCancerStudyIdentifier("study+es+0");
+
+    Set<ConstraintViolation<CancerStudy>> violations = validator.validate(cancerStudy);
+    Assert.assertFalse("Study identifier with plus signs should be invalid", violations.isEmpty());
+    Assert.assertTrue(
+        "Error message should mention allowed characters",
+        violations.iterator().next().getMessage().contains("alphanumeric"));
+  }
+
+  @Test
+  public void testInvalidStudyIdentifierWithSpace() {
+    CancerStudy cancerStudy = new CancerStudy();
+    cancerStudy.setCancerStudyIdentifier("study es 0");
+
+    Set<ConstraintViolation<CancerStudy>> violations = validator.validate(cancerStudy);
+    Assert.assertFalse("Study identifier with spaces should be invalid", violations.isEmpty());
+  }
+
+  @Test
+  public void testInvalidStudyIdentifierWithSpecialCharacters() {
+    CancerStudy cancerStudy = new CancerStudy();
+    cancerStudy.setCancerStudyIdentifier("study@es#0");
+
+    Set<ConstraintViolation<CancerStudy>> violations = validator.validate(cancerStudy);
+    Assert.assertFalse(
+        "Study identifier with special characters should be invalid", violations.isEmpty());
+  }
+
+  @Test
+  public void testInvalidStudyIdentifierWithPercent() {
+    CancerStudy cancerStudy = new CancerStudy();
+    cancerStudy.setCancerStudyIdentifier("study%20");
+
+    Set<ConstraintViolation<CancerStudy>> violations = validator.validate(cancerStudy);
+    Assert.assertFalse(
+        "Study identifier with percent encoding should be invalid", violations.isEmpty());
+  }
+
+  @Test
+  public void testNullStudyIdentifier() {
+    CancerStudy cancerStudy = new CancerStudy();
+    cancerStudy.setCancerStudyIdentifier(null);
+
+    Set<ConstraintViolation<CancerStudy>> violations = validator.validate(cancerStudy);
+    Assert.assertFalse("Null study identifier should be invalid", violations.isEmpty());
+  }
+}