diff --git a/src/main/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalVulnerability.java
index 9eb1c126d..9eccfe7a3 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalVulnerability.java
@@ -79,7 +79,8 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> readFile(
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel1(
             @RequestParam Map<String, String> queryParams) {
         String fileName = queryParams.get(URL_PARAM_KEY);
-        return this.readFile(() -> fileName != null, fileName);
+        return this.readFile(
+                () -> fileName != null && ALLOWED_FILE_NAMES.contains(fileName), fileName);
     }
 
     @AttackVector(
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalTest.java b/src/test/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalTest.java
index ed779b9cb..8001a1645 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalTest.java
@@ -32,15 +32,15 @@ void testGetVulnerablePayloadLevel1WithNullFileName() {
     }
 
     @Test
-    void testGetVulnerablePayloadLevel1WithWrongFileName() {
+    void testGetVulnerablePayloadLevel1RejectsDisallowedFileName() {
         Map<String, String> queryParams = new HashMap<>();
         queryParams.put("fileName", "../");
         ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
                 pathTraversalVulnerability.getVulnerablePayloadLevel1(queryParams);
         assertEquals(HttpStatus.OK, response.getStatusCode());
         assertNotNull(response.getBody());
-        assertTrue(response.getBody().getIsValid());
-        assertNotNull(response.getBody().getContent());
+        assertFalse(response.getBody().getIsValid());
+        assertNull(response.getBody().getContent());
     }
 
     @Test