diff --git a/core/Controller/UnifiedSearchController.php b/core/Controller/UnifiedSearchController.php
index 62fbc5dcccf96..925546c305d42 100644
--- a/core/Controller/UnifiedSearchController.php
+++ b/core/Controller/UnifiedSearchController.php
@@ -97,6 +97,9 @@ public function search(string $providerId,
 		}
 		[$route, $routeParameters] = $this->getRouteInformation($from);
 
+		$limit ??= SearchQuery::LIMIT_DEFAULT;
+		$limit = max(1, min($limit, 25));
+
 		return new DataResponse(
 			$this->composer->search(
 				$this->userSession->getUser(),
@@ -104,7 +107,7 @@ public function search(string $providerId,
 				new SearchQuery(
 					$term,
 					$sortOrder ?? ISearchQuery::SORT_DATE_DESC,
-					$limit ?? SearchQuery::LIMIT_DEFAULT,
+					$limit,
 					$cursor,
 					$route,
 					$routeParameters