diff --git a/confluent_server/confluent/messages.py b/confluent_server/confluent/messages.py
index 4dfbabf5..4f2aabc1 100644
--- a/confluent_server/confluent/messages.py
+++ b/confluent_server/confluent/messages.py
@@ -19,6 +19,7 @@
 # Things are defined here to 'encourage' developers to coordinate information
 # format.  This is also how different data formats are supported
 import base64
+import os
 import confluent.exceptions as exc
 import confluent.config.configmanager as cfm
 import confluent.config.conf as cfgfile
@@ -604,6 +605,9 @@ class InputFirmwareUpdate(ConfluentMessage):
             node, value = expanded
             if value != self._filename:
                 self._complexname = True
+            value = os.path.normpath(value)
+            if value.startswith('../'):
+                raise Exception('File transfer with ../ is not supported')
             self.filebynode[node] = value
 
     @property