1 files changed, 4 insertions, 0 deletions
diff --git a/config-lib/src/main/java/com/yahoo/config/FileNode.java b/config-lib/src/main/java/com/yahoo/config/FileNode.java
index a7c1ebb1488..e6a4af6f439 100644
--- a/config-lib/src/main/java/com/yahoo/config/FileNode.java
+++ b/config-lib/src/main/java/com/yahoo/config/FileNode.java
@@ -1,6 +1,8 @@
 // Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
 package com.yahoo.config;
 
+import java.nio.file.Path;
+
 /**
  * Represents a 'file' in a {@link ConfigInstance}, usually a filename.
  *
@@ -14,6 +16,8 @@ public class FileNode extends LeafNode<FileReference> {
     public FileNode(String stringVal) {
         super(true);
         this.value = new FileReference(ReferenceNode.stripQuotes(stringVal));
+        if (Path.of(value.value()).normalize().startsWith(".."))
+            throw new IllegalArgumentException("path may not start with '..', but got: " + value.value());
     }
 
     public FileReference value() {