May 8, 2023 · May 8, 2023
diff --git a/source/dub/recipe/packagerecipe.d b/source/dub/recipe/packagerecipe.d
@@ -494,6 +494,14 @@ struct BuildSettingsTemplate {
 					continue;
 
 				foreach (spath; paths) {
+					// exclude paths outside projects' roots from recursive globbing
+					import std.algorithm : startsWith;
+					import std.path : pathSplitter;
+					if (spath.pathSplitter.startsWith("..".only)) {
+						logDiagnostic("Not globbing path outside project root: %s", spath);
+						continue;
+					}
+
 					enforce(!spath.empty, "Paths must not be empty strings.");
 					auto path = NativePath(spath);
 					if (!path.absolute) path = base_path ~ path;

diff --git a/test/issue2637-parent-directory.sh b/test/issue2637-parent-directory.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+set -e
+
+. $(dirname "${BASH_SOURCE[0]}")/common.sh
+cd "${CURR_DIR}/issue2637-parent-directory"
+test ! -e bad || rmdir bad
+mkdir -m 000 bad
+trap 'rmdir bad' EXIT
+
+(
+	cd pkg
+	$DUB run
+)
diff --git a/test/issue2637-parent-directory/.no_build b/test/issue2637-parent-directory/.no_build
diff --git a/test/issue2637-parent-directory/pkg/.gitignore b/test/issue2637-parent-directory/pkg/.gitignore
@@ -0,0 +1 @@
+/pkg
diff --git a/test/issue2637-parent-directory/pkg/dub.sdl b/test/issue2637-parent-directory/pkg/dub.sdl
@@ -0,0 +1,4 @@
+name "pkg"
+targetType "executable"
+sourceFiles "prog.d"
+importPaths ".."
diff --git a/test/issue2637-parent-directory/pkg/mod.di b/test/issue2637-parent-directory/pkg/mod.di
@@ -0,0 +1,3 @@
+module pkg.mod;
+
+enum message = "Hello";
diff --git a/test/issue2637-parent-directory/pkg/prog.d b/test/issue2637-parent-directory/pkg/prog.d
@@ -0,0 +1,9 @@
+module pkg.prog;
+
+import std.stdio;
+import pkg.mod;
+
+void main()
+{
+	writeln(message);
+}