diff --git a/config/locales/server.en.yml b/config/locales/server.en.yml
index 7c92a5e..083ef16 100644
--- a/config/locales/server.en.yml
+++ b/config/locales/server.en.yml
@@ -6,6 +6,7 @@ en:
       recurring_data_explorer_result_pm:
         title: Schedule a PM with Data Explorer results
         description: Get scheduled reports sent to your messages
+        no_csv_allowed: "When using `attach_csv` field, `csv` must be added to the list of authorized extensions in the site settings."
       recurring_data_explorer_result_topic:
         title: Schedule a post in a topic with Data Explorer results
         description: Get scheduled reports posted to a specific topic
diff --git a/plugin.rb b/plugin.rb
index 7f1ec0a..df79050 100644
--- a/plugin.rb
+++ b/plugin.rb
@@ -82,7 +82,18 @@ after_initialize do
         field :query_id, component: :choices, required: true, extra: { content: queries }
         field :query_params, component: :"key-value", accepts_placeholders: true
         field :skip_empty, component: :boolean
-        field :attach_csv, component: :boolean
+        field :attach_csv,
+              component: :boolean,
+              validator: ->(attach_csv) do
+                return if !attach_csv
+
+                extensions = SiteSetting.authorized_extensions.split("|")
+                if (extensions & %w[csv *]).empty?
+                  I18n.t(
+                    "discourse_automation.scriptables.recurring_data_explorer_result_pm.no_csv_allowed",
+                  )
+                end
+              end
 
         version 1
         triggerables [:recurring]
diff --git a/spec/automation/recurring_data_explorer_result_pm_spec.rb b/spec/automation/recurring_data_explorer_result_pm_spec.rb
index 39aefff..775d03e 100644
--- a/spec/automation/recurring_data_explorer_result_pm_spec.rb
+++ b/spec/automation/recurring_data_explorer_result_pm_spec.rb
@@ -126,4 +126,27 @@ describe "RecurringDataExplorerResultPM" do
       )
     end
   end
+
+  context "when using attach_csv" do
+    it "requires csv to be in authorized extensions" do
+      SiteSetting.authorized_extensions = "pdf|txt"
+
+      expect { automation.upsert_field!("attach_csv", "boolean", { value: true }) }.to raise_error(
+        ActiveRecord::RecordInvalid,
+        /#{I18n.t("discourse_automation.scriptables.recurring_data_explorer_result_pm.no_csv_allowed")}/,
+      )
+
+      SiteSetting.authorized_extensions = "pdf|txt|csv"
+
+      expect {
+        automation.upsert_field!("attach_csv", "boolean", { value: true })
+      }.to_not raise_error
+
+      SiteSetting.authorized_extensions = "*"
+
+      expect {
+        automation.upsert_field!("attach_csv", "boolean", { value: true })
+      }.to_not raise_error
+    end
+  end
 end