diff --git a/modules/transports/core/vfs/src/main/java/org/apache/synapse/transport/vfs/VFSTransportSender.java b/modules/transports/core/vfs/src/main/java/org/apache/synapse/transport/vfs/VFSTransportSender.java
index d2f30f4de..ef1d7f625 100644
--- a/modules/transports/core/vfs/src/main/java/org/apache/synapse/transport/vfs/VFSTransportSender.java
+++ b/modules/transports/core/vfs/src/main/java/org/apache/synapse/transport/vfs/VFSTransportSender.java
@@ -33,6 +33,7 @@
 import org.apache.axis2.transport.base.ManagementSupport;
 import org.apache.commons.io.output.CountingOutputStream;
 import org.apache.commons.logging.LogFactory;
+import org.apache.commons.vfs2.FileName;
 import org.apache.commons.vfs2.FileObject;
 import org.apache.commons.vfs2.FileSystemException;
 import org.apache.commons.vfs2.FileSystemManager;
@@ -160,6 +161,7 @@ public void sendMessage(MessageContext msgCtx, String targetAddress,
                 
                 if (replyFile.exists()) {
                     if (replyFile.getType() == FileType.FOLDER) {
+                        validateReplyFileNameFromTransportHeaders(replyFile, msgCtx);
                         if (isUseTempFile) {
                             tempTargetFileName = VFSUtils.generateTempFileName();
                             actualTargetFileName = VFSUtils.getFileName(msgCtx, vfsOutInfo);
@@ -256,6 +258,26 @@ public void sendMessage(MessageContext msgCtx, String targetAddress,
         }
     }
 
+    private void validateReplyFileNameFromTransportHeaders(FileObject replyFolder,
+                                                           MessageContext msgCtx)
+            throws FileSystemException, AxisFault {
+
+        String fileName = VFSUtils.getReplyFileNameFromTransportHeaders(msgCtx);
+        if (fileName == null) {
+            return;
+        }
+
+        FileName replyFolderName = replyFolder.getName();
+        FileName resolvedName = fsManager.resolveFile(replyFolder, fileName).getName();
+        if (!replyFolderName.isDescendent(resolvedName)) {
+            handleException("The " + VFSConstants.REPLY_FILE_NAME + " transport header value : " +
+                    VFSUtils.maskURLPassword(fileName) + " resolves to " +
+                    VFSUtils.maskURLPassword(resolvedName.getURI()) +
+                    " which is outside the reply folder : " +
+                    VFSUtils.maskURLPassword(replyFolderName.getURI()));
+        }
+    }
+
     private void populateResponseFile(FileObject responseFile, MessageContext msgContext,
                                       boolean append, boolean lockingEnabled) throws AxisFault {
         
diff --git a/modules/transports/core/vfs/src/main/java/org/apache/synapse/transport/vfs/VFSUtils.java b/modules/transports/core/vfs/src/main/java/org/apache/synapse/transport/vfs/VFSUtils.java
index b064ee7aa..0ac985e68 100644
--- a/modules/transports/core/vfs/src/main/java/org/apache/synapse/transport/vfs/VFSUtils.java
+++ b/modules/transports/core/vfs/src/main/java/org/apache/synapse/transport/vfs/VFSUtils.java
@@ -68,14 +68,17 @@ public static String getProperty(FileContent message, String property) {
         return null;
     }
 
-    public static String getFileName(MessageContext msgCtx, VFSOutTransportInfo vfsOutInfo) {
-        String fileName = null;
-
-        // first preference to a custom filename set on the current message context
+    public static String getReplyFileNameFromTransportHeaders(MessageContext msgCtx) {
         Map transportHeaders = (Map) msgCtx.getProperty(MessageContext.TRANSPORT_HEADERS);
         if (transportHeaders != null) {
-            fileName = (String) transportHeaders.get(VFSConstants.REPLY_FILE_NAME);
+            return (String) transportHeaders.get(VFSConstants.REPLY_FILE_NAME);
         }
+        return null;
+    }
+
+    public static String getFileName(MessageContext msgCtx, VFSOutTransportInfo vfsOutInfo) {
+        // first preference to a custom filename set on the current message context
+        String fileName = getReplyFileNameFromTransportHeaders(msgCtx);
 
         // if not, does the service (in its service.xml) specify one?
         if (fileName == null) {