1 files changed, 9 insertions, 1 deletions
diff --git a/config-lib/src/main/java/com/yahoo/config/FileNode.java b/config-lib/src/main/java/com/yahoo/config/FileNode.java
index a7c1ebb1488..3bcccb6d6b1 100644
--- a/config-lib/src/main/java/com/yahoo/config/FileNode.java
+++ b/config-lib/src/main/java/com/yahoo/config/FileNode.java
@@ -1,6 +1,8 @@
 // Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
 package com.yahoo.config;
 
+import java.nio.file.Path;
+
 /**
  * Represents a 'file' in a {@link ConfigInstance}, usually a filename.
  *
@@ -13,7 +15,13 @@ public class FileNode extends LeafNode<FileReference> {
 
     public FileNode(String stringVal) {
         super(true);
-        this.value = new FileReference(ReferenceNode.stripQuotes(stringVal));
+        Path path = Path.of(ReferenceNode.stripQuotes(stringVal)).normalize();
+        if (path.isAbsolute())
+            throw new IllegalArgumentException("path must be relative");
+        if (path.startsWith(".."))
+            throw new IllegalArgumentException("'..' not allowed in path");
+
+        this.value = new FileReference(path.toString());
     }
 
     public FileReference value() {