diff --git a/api/config/list.go b/api/config/list.go
index 4bf1f992..44b31aa4 100644
--- a/api/config/list.go
+++ b/api/config/list.go
@@ -18,7 +18,6 @@ func GetConfigs(c *gin.Context) {
 	dir := c.DefaultQuery("dir", "/")
 
 	configFiles, err := os.ReadDir(nginx.GetConfPath(dir))
-
 	if err != nil {
 		api.ErrHandler(c, err)
 		return
diff --git a/internal/nginx/config_args.go b/internal/nginx/config_args.go
index 0c15d556..fdcb0b48 100644
--- a/internal/nginx/config_args.go
+++ b/internal/nginx/config_args.go
@@ -1,6 +1,7 @@
 package nginx
 
 import (
+	"github.com/0xJacky/Nginx-UI/internal/helper"
 	"github.com/0xJacky/Nginx-UI/internal/logger"
 	"github.com/0xJacky/Nginx-UI/settings"
 	"os/exec"
@@ -31,7 +32,13 @@ func GetConfPath(dir ...string) (confPath string) {
 		confPath = settings.NginxSettings.ConfigDir
 	}
 
-	return filepath.Join(confPath, filepath.Join(dir...))
+	joined := filepath.Clean(filepath.Join(confPath, filepath.Join(dir...)))
+
+	if !helper.IsUnderDirectory(confPath, joined) {
+		return confPath
+	}
+
+	return
 }
 
 func GetPIDPath() (path string) {