diff --git a/library/Class/FileManager.php b/library/Class/FileManager.php
index 56f450fd5532c1cd80694012c9c1f65087d22981..86e39cbad7bff8254414eddb72f8f1e91ba9da78 100644
--- a/library/Class/FileManager.php
+++ b/library/Class/FileManager.php
@@ -35,6 +35,18 @@ class Class_FileManager {
 
 
   protected function _isForbidden($part) {
-    return in_array($part, ['..', '.htaccess']);
+    return $this->_isHtaccess($part) || $this->_isDotsOnly($part);
+  }
+
+
+  protected function _isHtaccess($part) {
+    return '.htaccess' == trim($part);
+  }
+
+
+  protected function _isDotsOnly($part) {
+    return $part
+      ? '' == trim(str_replace('.', '', $part))
+      : false;
   }
 }
diff --git a/tests/library/Class/FileManagerTest.php b/tests/library/Class/FileManagerTest.php
index 8a04970eec2e2120475595e87774fbd41547098a..a551d54de5bfc1ea7c8c541b76f3e649255518a8 100644
--- a/tests/library/Class/FileManagerTest.php
+++ b/tests/library/Class/FileManagerTest.php
@@ -46,15 +46,14 @@ class FileManagerAuthTest extends FileManagerTestCase {
                                     'password' => 'admin']);
     $this->_admin->beModoBib()->save();
 
-
     $this->_guest = $this->fixture('Class_Users',
                                    ['id' => 3,
                                     'login' => 'guest',
                                     'password' => 'guest']);
     $this->_guest->beInvite()->save();
-
   }
 
+
   /** @test */
   public function withoutAuthenticationUserfilesShouldNotBeAuthorized() {
     $this->assertFalse($this->_filemanager->isAuthorized(USERFILESURL . 'images/bokeh.png'));
@@ -105,6 +104,12 @@ class FileManagerAuthAsAdminTest extends FileManagerTestCase {
   }
 
 
+  /** @test */
+  public function megaUpperDirectoryShouldNotBeAuthorized() {
+    $this->assertFalse($this->_filemanager->isAuthorized(USERFILESURL . '....//'));
+  }
+
+
   /**
    * @test
    * @see http://forge.afi-sa.fr/issues/32417
@@ -115,7 +120,7 @@ class FileManagerAuthAsAdminTest extends FileManagerTestCase {
 
 
   /** @test */
-  public function dotHtaccessShouldNotBeDownloadable() {
+  public function dotHtaccessShouldNotBeAuthorized() {
     $this->assertFalse($this->_filemanager->isAuthorized(USERFILESURL . '/.htaccess'));
   }
 }
\ No newline at end of file