--- a/mod_muc_cache_media/mod_muc_cache_media.lua	Tue Feb 24 13:20:45 2026 -0500
+++ b/mod_muc_cache_media/mod_muc_cache_media.lua	Tue Feb 24 15:26:37 2026 -0500
@@ -73,6 +73,10 @@
 	return url:match(".*/([^/?]+)$") or "file"
 end
 
+local function pattern_from_string(s)
+	return s:gsub("[%(%)%.%%%+%-%*%?%[%]%^%$]", function(c) return "%" .. c end)
+end
+
 local function secure_download_to_disk(url)
 	local parsed = socket_url.parse(url)
 	if not parsed or (parsed.scheme~="http" and parsed.scheme~="https") then return promise.reject("invalid scheme") end
@@ -181,11 +185,11 @@
 
 			stanza:maptags(function(el)
 				if el.name == "body" then
-					return st.stanza("body"):text(el:get_text():gsub(original_url, data.local_url))
+					return st.stanza("body"):text(el:get_text():gsub(pattern_from_string(original_url), data.local_url))
 				elseif el.name == "fallback" and el.attr.xmlns == "urn:xmpp:fallback:0" and (el.attr["for"] == "jabber:x:oob" or el.attr["for"] == "urn:xmpp:sims:1") then
 					return el:maptags(function(subel)
-						local s, e = string.find(original_body, original_url)
-						if subel.name == "body" and math.abs(s - tonumber(subel.attr.start)) < 5 then
+						local s, e = string.find(original_body, original_url, 1, true)
+						if s and subel.name == "body" and math.abs(s - tonumber(subel.attr.start)) < 5 then
 							subel.attr["end"] = tostring((tonumber(subel.attr["end"]) - #original_url) + #data.local_url)
 						end
 						return subel