diff --git a/lib/files.js b/lib/files.js
index 79767ff..5550483 100644
--- a/lib/files.js
+++ b/lib/files.js
@@ -23,7 +23,7 @@ module.exports = (base, default_price, invoice_ttl, files_attr) => {
         , ext      = fileExt(name)
         , attr     = files_attr[relpath] || {}
 
-    if (/^\.?\//.test(relpath) || reIgnore.test(name)) throw new Error('forbidden')
+    if (/^\.\.\//.test(relpath) || reIgnore.test(name)) throw new Error('forbidden')
 
     const file = { fullpath, path: relpath, urlpath: escape(relpath), name, ext, dirname, attr }
         , stat = await fs.stat(fullpath)