diff --git a/app/controllers/announcements_controller.rb b/app/controllers/announcements_controller.rb
index 752458e..de4ec49 100644
--- a/app/controllers/announcements_controller.rb
+++ b/app/controllers/announcements_controller.rb
@@ -497,6 +497,7 @@ class AnnouncementsController < ApplicationController
   end
   def get_file
     @url = request.path
+    render :text => "Path not allow",:status => 404 if @url.match(/\/\.\./)
     begin
       file = BulletinFile.find(params[:id])
       if File.basename(file.file.path) != URI.decode(params[:f_name])