diff --git a/emhttp/update.php b/emhttp/update.php
index b1b91fee6b..4046ca4a89 100644
--- a/emhttp/update.php
+++ b/emhttp/update.php
@@ -114,7 +114,7 @@ function write_log($string) {
   if (strpos($command, $docroot) !== 0)
     $command = "$docroot/$command";
   $command = realpath($command);
-  if ($command === false)
+  if ($command === false || strpos($command, rtrim(realpath($docroot), '/') . '/') !== 0)
     syslog(LOG_INFO, "Invalid #command: {$_POST['#command']}");
   else {
     $command = escapeshellcmd($command);