diff --git a/mdeploy.php b/mdeploy.php
index 437452348f7..26c5caa1970 100644
--- a/mdeploy.php
+++ b/mdeploy.php
@@ -736,6 +736,7 @@ class worker extends singleton_pattern {
 
     /** @var array the whitelisted config options which can be queried. */
     private $validconfigoptions = array(
+        'dirroot'       => true,
         'dataroot'      => true,
     );
 
@@ -781,8 +782,13 @@ class worker extends singleton_pattern {
             }
             $this->log('MD5 checksum ok');
 
-            // Backup the current version of the plugin
+            // Check that the specified typeroot is within the current site's dirroot.
             $plugintyperoot = $this->input->get_option('typeroot');
+            if (strpos(realpath($plugintyperoot), realpath($this->get_env('dirroot'))) !== 0) {
+                throw new backup_folder_exception('Unable to backup the current version of the plugin (typeroot is invalid)');
+            }
+
+            // Backup the current version of the plugin
             $pluginname = $this->input->get_option('name');
             $sourcelocation = $plugintyperoot.'/'.$pluginname;
             $backuplocation = $this->backup_location($sourcelocation);
@@ -826,6 +832,10 @@ class worker extends singleton_pattern {
             $source         = $this->input->get_option('package');
             $md5remote      = $this->input->get_option('md5');
 
+            if (strpos(realpath($plugintyperoot), realpath($this->get_env('dirroot'))) !== 0) {
+                throw new backup_folder_exception('Unable to prepare the plugin location (typeroot is invalid)');
+            }
+
             // Check if the plugin location if available for us.
             $pluginlocation = $plugintyperoot.'/'.$pluginname;
 
diff --git a/mdeploytest.php b/mdeploytest.php
index 98a8d9b73da..dcd2dfddde1 100644
--- a/mdeploytest.php
+++ b/mdeploytest.php
@@ -364,6 +364,7 @@ class mdeploytest extends PHPUnit_Framework_TestCase {
     public function get_env_valid_provider() {
         return array(
             array('dataroot'),
+            array('dirroot'),
         );
     }
 }