1 files changed, 7 insertions, 1 deletions
diff --git a/config-lib/src/main/java/com/yahoo/config/PathNode.java b/config-lib/src/main/java/com/yahoo/config/PathNode.java
index 1c4f724a7ed..2c43f89af3f 100644
--- a/config-lib/src/main/java/com/yahoo/config/PathNode.java
+++ b/config-lib/src/main/java/com/yahoo/config/PathNode.java
@@ -23,7 +23,13 @@ public class PathNode extends LeafNode<Path> {
 
     public PathNode(FileReference fileReference) {
         super(true);
-        this.value = new File(fileReference.value()).toPath();
+        Path value = Path.of(fileReference.value()).normalize();
+        if (value.isAbsolute())
+            throw new IllegalArgumentException("path must be relative");
+        if (value.startsWith(".."))
+            throw new IllegalArgumentException("'..' not allowed in path");
+
+        this.value = value;
         this.fileReference = fileReference;
     }