diff --git a/controllers/admin/AdminImportController.php b/controllers/admin/AdminImportController.php
index 0f06fa577..95e0ab6bf 100644
--- a/controllers/admin/AdminImportController.php
+++ b/controllers/admin/AdminImportController.php
@@ -2802,6 +2802,8 @@ class AdminImportControllerCore extends AdminController
 		{
 			$filename = base64_decode($filename);
 			$file =  _PS_ADMIN_DIR_.'/import/'.basename($filename);
+			if (realpath(dirname($file)) != _PS_ADMIN_DIR_.'/import')
+				exit();
 			if (!empty($filename) && file_exists($file))
 			{
 				$bName = basename($filename);