diff --git a/api/setup/saveWizard.cfm b/api/setup/saveWizard.cfm
index 0351917..dcc1bbd 100644
--- a/api/setup/saveWizard.cfm
+++ b/api/setup/saveWizard.cfm
@@ -142,6 +142,9 @@ try {
         throw(message="No request body provided");
     }
 
+    // Clean control characters that Lucee's JSON parser can't handle
+    requestBody = reReplace(requestBody, "[\x00-\x08\x0B\x0C\x0E-\x1F]", "", "all");
+
     data = deserializeJSON(requestBody);
 
     businessId = structKeyExists(data, "businessId") ? val(data.businessId) : 0;