diff --git a/src/test/java/org/apache/uima/json/jsoncas2/Fixtures.java b/src/test/java/org/apache/uima/json/jsoncas2/Fixtures.java
index 74f54dd..ff44a10 100644
--- a/src/test/java/org/apache/uima/json/jsoncas2/Fixtures.java
+++ b/src/test/java/org/apache/uima/json/jsoncas2/Fixtures.java
@@ -94,6 +94,10 @@ public static Path materializeTestSuite()
                         }
 
                         Path target = targetBase.resolve(name);
+
+                      if (!target.normalize().startsWith(targetBase.normalize())) {
+                        throw new RuntimeException("Bad zip entry");
+                      }
                         Files.createDirectories(target.getParent());
 
                         try (InputStream eis = zipFile.getInputStream(entry);