1 files changed, 12 insertions, 1 deletions
diff --git a/Build/source/texk/dvipdfm-x/dvipdfmx.c b/Build/source/texk/dvipdfm-x/dvipdfmx.c
index f56c1d44ed3..3a4dfa35364 100644
--- a/Build/source/texk/dvipdfm-x/dvipdfmx.c
+++ b/Build/source/texk/dvipdfm-x/dvipdfmx.c
@@ -614,8 +614,19 @@ do_args_second_pass (int argc, char *argv[], const char *source, int unsafe)
 
     case 'i':
     {
+/*
+ -i ./foo.cfg, -i /usr/abc/foo.cfg, etc. are not allowed for
+ security reason.
+*/
+      char *dir1, *dir2;
       int optind_save= optind;
-      read_config_file(optarg);
+      dir1 = strrchr(optarg, '/');
+      dir2 = strrchr(optarg, '\\');
+      if (dir1 || dir2) {
+        WARN("%s is not allowed. Default configuration file is used.", optarg);
+      } else {
+        read_config_file(optarg);
+      }
       optind = optind_save;
       break;
     }