diff --git a/config/policy-secure.xml b/config/policy-secure.xml
index bc2763b727..87b20334f6 100644
--- a/config/policy-secure.xml
+++ b/config/policy-secure.xml
@@ -93,6 +93,8 @@
   <policy domain="path" rights="none" pattern="fd:*"/>
   <!-- don't read sensitive paths. -->
   <policy domain="path" rights="none" pattern="/etc/*"/>
+  <!-- Relative paths are not permitted. -->
+  <policy domain="path" rights="none" pattern="\.\.\/"/>
   <!-- Indirect reads are not permitted. -->
   <policy domain="path" rights="none" pattern="@*"/>
   <!-- These image types are security risks on read, but write is fine -->
diff --git a/config/policy-websafe.xml b/config/policy-websafe.xml
index 9c7a5b8c96..48eca735d2 100644
--- a/config/policy-websafe.xml
+++ b/config/policy-websafe.xml
@@ -89,6 +89,8 @@
   <policy domain="path" rights="none" pattern="fd:*"/>
   <!-- don't read sensitive paths. -->
   <policy domain="path" rights="none" pattern="/etc/*"/>
+  <!-- Relative paths are not permitted. -->
+  <policy domain="path" rights="none" pattern="\.\.\/"/>
   <!-- Indirect reads are not permitted. -->
   <policy domain="path" rights="none" pattern="@*"/>
   <!-- Deny all image modules and specifically exempt reading or writing