A small boy almost fell from a moving train carriage on to the track below because the toilet floor was missing.
His mother was able to catch him before he fell when she took him to the toilet on the Totnes Riverside to Buckfastleigh train in Devon.
Investigators said the floor had been removed for repairs to the carriage's brakes but had not been replaced.
South Devon Railway (SDR), which runs the steam train, said it is taking the investigation "extremely seriously".
The Rail Accident Investigation Branch (RAIB) said the 13:00 BST train was running between Staverton and Buckfastleigh on the South Devon Railway when the mother took her child to the toilet in the fourth carriage on 22 June.
The train was travelling at about 20mph (32 km/h) when they opened the door and saw the floor of the compartment was missing, exposing the carriage wheels below.
She reported the matter to the train guard and the door was locked.
The mother and child were left shocked and the boy suffered minor bruising.
Staff had previously placed a notice on the door and tried to secure it to prevent it being opened, but those measures were not effective, the RAIB said.
Its investigation, which will look at the repairs to the carriage, the adequacy of the measures to secure the door and the railway's systems for assuring the safety of rolling stock in service, will be published in due course.
An investigation has also been launched by the Office of Rail and Road (ORR).
A registered charity, SDR is a seven-mile former Great Western Railway branch line which runs steam trains and heritage rolling stock as a tourist attraction.
In a statement, SDR apologised and said: "On the day in question, something clearly went wrong with our safety control and hazard monitoring systems as evidenced by the incident having taken place - it simply should not have happened."