diff --git a/functions/api/infractions/new.ts b/functions/api/infractions/new.ts
index ada5628..99f4922 100644
--- a/functions/api/infractions/new.ts
+++ b/functions/api/infractions/new.ts
@@ -51,8 +51,24 @@ export async function onRequestPost(context: RequestContext) {
   if (!(body.get("user") as string).match(/^\d{17,19}$/))
     return jsonError("Invalid user", 400);
 
-  // @ts-expect-error
-  const files: File[] = body.keys().find((key) => key.match(/^files\[\d]$/));
+  const fileKeys = Array.from(body.keys()).filter((key) =>
+    key.match(/^file\d$/),
+  );
+
+  if (fileKeys.length > 5)
+    return jsonError("Only up to five files are allowed per infraction", 400);
+
+  const files: File[] = [];
+
+  for (const fileKey of fileKeys) {
+    const file = body.get(fileKey);
+
+    if (!(file instanceof File))
+      return jsonError("File keys can only contain files", 400);
+
+    files.push(file);
+  }
+
   const urlPromises = [];
   const origin = context.request.headers.get("Origin");