diff --git a/libs/threejs/76/utils/servers/simplehttpserver.js b/libs/threejs/76/utils/servers/simplehttpserver.js
index 25af726..68d31cb 100644
--- a/libs/threejs/76/utils/servers/simplehttpserver.js
+++ b/libs/threejs/76/utils/servers/simplehttpserver.js
@@ -26,6 +26,11 @@ function handleRequest(request, response) {
 
 	var urlObject = urlParser.parse(request.url, true);
 	var pathname = decodeURIComponent(urlObject.pathname);
+    if (path.normalize(decodeURIComponent(urlObject.pathname)) !== decodeURIComponent(urlObject.pathname)) {
+        response.statusCode = 403;
+        response.end();
+        return;
+    }
 
 	console.log('[' + (new Date()).toUTCString() + '] ' + '"' + request.method + ' ' + pathname + '"');