diff --git a/2_training_platform/train-platform/src/main/java/top/aias/training/common/utils/ZipUtil.java b/2_training_platform/train-platform/src/main/java/top/aias/training/common/utils/ZipUtil.java
index 0d8e086a..b83d6641 100644
--- a/2_training_platform/train-platform/src/main/java/top/aias/training/common/utils/ZipUtil.java
+++ b/2_training_platform/train-platform/src/main/java/top/aias/training/common/utils/ZipUtil.java
@@ -61,7 +61,12 @@ public static void unZipTrainingData(String receivedZipFile, String osName, Stri
                 }
 
                 filename = filePath + File.separator + filename;
-                File file = new File(filename);
+                File file = new File(filePath, filename);
+                if (!file.toPath().normalize().startsWith(Paths.get(filePath).normalize())) {
+                  log.error("Zip entry attempts path traversal: {}", filename);
+                  throw new SecurityException("Zip entry attempts path traversal: " + filename);
+                }
+                
                 if (!file.exists()) {
                     if (ismkdir) {
                         new File(filename.substring(0, filename.lastIndexOf("/"))).mkdirs();