diff -r a2b8c201727f -r 3a38f779bed5 cubicweb/pyramid/debug_source_code.py
--- a/cubicweb/pyramid/debug_source_code.py	Fri Sep 27 06:51:29 2019 +0200
+++ b/cubicweb/pyramid/debug_source_code.py	Thu Sep 26 06:27:53 2019 +0200
@@ -33,6 +33,8 @@
 
 DEBUG_DISPLAY_SOURCE_CODE_PATH = '_debug_display_source_code'
 
+FILES_WHITE_LIST = set()
+
 
 def source_code_url(object_or_class):
     if object_or_class is None:
@@ -47,6 +49,8 @@
         logging.debug("Error while trying to source code of '%s'" % object_or_class)
         return ""
 
+    FILES_WHITE_LIST.add(file_path)
+
     try:
         source_code, line = inspect.getsourcelines(object_or_class)
     except OSError:  # when we couldn't read the source code/line
@@ -81,6 +85,10 @@
     if not os.path.exists(source_code_file):
         return Response("Error: file '%s' doesn't exist on the filesystem." % source_code_file)
 
+    # security
+    if source_code_file not in FILES_WHITE_LIST:
+        return Response("Error: access to file is not authorized")
+
     try:
         content = open(source_code_file, "r").read()
     except Exception as e: