diff --git a/wavesrv/cmd/main-server.go b/wavesrv/cmd/main-server.go
index ef07a022..d1b60815 100644
--- a/wavesrv/cmd/main-server.go
+++ b/wavesrv/cmd/main-server.go
@@ -1018,6 +1018,11 @@ func doShutdown(reason string) {
 
 func configDirHandler(w http.ResponseWriter, r *http.Request) {
 	configPath := r.URL.Path
+	if !fs.ValidPath(configPath) && !strings.Contains(configPath, "..") {
+		w.WriteHeader(http.StatusInternalServerError)
+		w.Write([]byte(fmt.Sprintf("invalid path: %s", configPath)))
+		return
+	}
 	configFullPath := path.Join(scbase.GetWaveHomeDir(), configPath)
 	dirFile, err := os.Open(configFullPath)
 	if err != nil {