diff --git a/http/src/main/scala/org/apache/pekko/http/javadsl/server/directives/FileAndResourceDirectives.scala b/http/src/main/scala/org/apache/pekko/http/javadsl/server/directives/FileAndResourceDirectives.scala
index a7b61e1f7..17c7de185 100644
--- a/http/src/main/scala/org/apache/pekko/http/javadsl/server/directives/FileAndResourceDirectives.scala
+++ b/http/src/main/scala/org/apache/pekko/http/javadsl/server/directives/FileAndResourceDirectives.scala
@@ -50,6 +50,10 @@ abstract class FileAndResourceDirectives extends ExecutionDirectives {
    * Completes GET requests with the content of the given resource loaded from the default ClassLoader,
    * using the default content type resolver.
    * If the resource cannot be found or read the Route rejects the request.
+   *
+   * The path is passed to the class loader as given: unlike `getFromResourceDirectory` this directive does not
+   * reject `..` or separator characters, so a path built from request input can resolve to a resource outside the
+   * intended prefix. Validate any request-derived part of the path, or use `getFromResourceDirectory` instead.
    */
   def getFromResource(path: String): Route = RouteAdapter {
     D.getFromResource(path)
diff --git a/http/src/main/scala/org/apache/pekko/http/scaladsl/server/directives/FileAndResourceDirectives.scala b/http/src/main/scala/org/apache/pekko/http/scaladsl/server/directives/FileAndResourceDirectives.scala
index 19a6c9955..c97e50bcf 100644
--- a/http/src/main/scala/org/apache/pekko/http/scaladsl/server/directives/FileAndResourceDirectives.scala
+++ b/http/src/main/scala/org/apache/pekko/http/scaladsl/server/directives/FileAndResourceDirectives.scala
@@ -94,6 +94,10 @@ trait FileAndResourceDirectives {
    * Completes GET requests with the content of the given class-path resource.
    * If the resource cannot be found or read the Route rejects the request.
    *
+   * The resource name is passed to the class loader as given: unlike `getFromResourceDirectory` this directive does
+   * not reject `..` or separator characters, so a name built from request input can resolve to a resource outside the
+   * intended prefix. Validate any request-derived part of the name, or use `getFromResourceDirectory` instead.
+   *
    * @group fileandresource
    */
   def getFromResource(resourceName: String)(implicit resolver: ContentTypeResolver): Route =
@@ -103,6 +107,8 @@ trait FileAndResourceDirectives {
    * Completes GET requests with the content of the given resource.
    * If the resource is a directory or cannot be found or read the Route rejects the request.
    *
+   * The resource name is not checked for path traversal, see `getFromResource(resourceName)` above.
+   *
    * @group fileandresource
    */
   def getFromResource(