diff --git a/gns3server/web/web_server.py b/gns3server/web/web_server.py
index be24f2ab..8a2f2ff9 100644
--- a/gns3server/web/web_server.py
+++ b/gns3server/web/web_server.py
@@ -43,8 +43,8 @@ import gns3server.handlers
 import logging
 log = logging.getLogger(__name__)
 
-if not aiohttp.__version__.startswith("2.0"):
-    raise RuntimeError("You need aiohttp 2.0 for running GNS3")
+if not aiohttp.__version__.startswith("2.2"):
+    raise RuntimeError("aiohttp 2.0 is required to run the GNS3 server")
 
 
 class WebServer:
diff --git a/requirements.txt b/requirements.txt
index bcfc7289..66ae7e03 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,7 +1,7 @@
 jsonschema>=2.4.0
-aiohttp>=2.0.7,<2.1.0 # pyup: ignore
+aiohttp>=2.2.0,<2.3.0 # pyup: ignore
 aiohttp-cors>=0.5.3,<0.6.0 # pyup: ignore
-yarl>=0.10.2,<0.11 # pyup: ignore
+yarl>=0.11,<0.12 # pyup: ignore
 Jinja2>=2.7.3
 raven>=5.23.0
 psutil>=3.0.0
diff --git a/tests/handlers/api/compute/test_project.py b/tests/handlers/api/compute/test_project.py
index 25d3d8c2..a1e1cd42 100644
--- a/tests/handlers/api/compute/test_project.py
+++ b/tests/handlers/api/compute/test_project.py
@@ -136,7 +136,7 @@ def test_get_file(http_compute, tmpdir):
     assert response.status == 404
 
     response = http_compute.get("/projects/{project_id}/files/../hello".format(project_id=project.id), raw=True)
-    assert response.status == 403
+    assert response.status == 404
 
 
 def test_write_file(http_compute, tmpdir):
@@ -151,7 +151,7 @@ def test_write_file(http_compute, tmpdir):
         assert f.read() == "world"
 
     response = http_compute.post("/projects/{project_id}/files/../hello".format(project_id=project.id), raw=True)
-    assert response.status == 403
+    assert response.status == 404
 
 
 def test_stream_file(http_compute, tmpdir):
@@ -170,4 +170,4 @@ def test_stream_file(http_compute, tmpdir):
     assert response.status == 404
 
     response = http_compute.get("/projects/{project_id}/files/../hello".format(project_id=project.id), raw=True)
-    assert response.status == 403
+    assert response.status == 404
diff --git a/tests/handlers/api/compute/test_qemu.py b/tests/handlers/api/compute/test_qemu.py
index 4e049d4f..41dd385a 100644
--- a/tests/handlers/api/compute/test_qemu.py
+++ b/tests/handlers/api/compute/test_qemu.py
@@ -258,7 +258,7 @@ def test_upload_image_ova(http_compute, tmpdir):
 def test_upload_image_forbiden_location(http_compute, tmpdir):
     with patch("gns3server.compute.Qemu.get_images_directory", return_value=str(tmpdir),):
         response = http_compute.post("/qemu/images/../../test2", body="TEST", raw=True)
-        assert response.status == 403
+        assert response.status == 404
 
 
 def test_upload_image_permission_denied(http_compute, tmpdir):
diff --git a/tests/handlers/api/controller/test_node.py b/tests/handlers/api/controller/test_node.py
index eb795c7c..635c1e93 100644
--- a/tests/handlers/api/controller/test_node.py
+++ b/tests/handlers/api/controller/test_node.py
@@ -234,7 +234,7 @@ def test_get_file(http_controller, tmpdir, project, node, compute):
     compute.http_query.assert_called_with("GET", "/projects/{project_id}/files/project-files/vpcs/{node_id}/hello".format(project_id=project.id, node_id=node.id), timeout=None, raw=True)
 
     response = http_controller.get("/projects/{project_id}/nodes/{node_id}/files/../hello".format(project_id=project.id, node_id=node.id), raw=True)
-    assert response.status == 403
+    assert response.status == 404
 
 
 def test_post_file(http_controller, tmpdir, project, node, compute):
@@ -245,4 +245,4 @@ def test_post_file(http_controller, tmpdir, project, node, compute):
     compute.http_query.assert_called_with("POST", "/projects/{project_id}/files/project-files/vpcs/{node_id}/hello".format(project_id=project.id, node_id=node.id), data=b'hello', timeout=None, raw=True)
 
     response = http_controller.get("/projects/{project_id}/nodes/{node_id}/files/../hello".format(project_id=project.id, node_id=node.id), raw=True)
-    assert response.status == 403
+    assert response.status == 404
diff --git a/tests/handlers/api/controller/test_project.py b/tests/handlers/api/controller/test_project.py
index 6290ed2c..7381bd5d 100644
--- a/tests/handlers/api/controller/test_project.py
+++ b/tests/handlers/api/controller/test_project.py
@@ -203,7 +203,7 @@ def test_get_file(http_controller, tmpdir, loop, project):
     assert response.status == 404
 
     response = http_controller.get("/projects/{project_id}/files/../hello".format(project_id=project.id), raw=True)
-    assert response.status == 403
+    assert response.status == 404
 
 
 def test_write_file(http_controller, tmpdir, project):
@@ -214,7 +214,7 @@ def test_write_file(http_controller, tmpdir, project):
         assert f.read() == "world"
 
     response = http_controller.post("/projects/{project_id}/files/../hello".format(project_id=project.id), raw=True)
-    assert response.status == 403
+    assert response.status == 404
 
 
 def test_write_and_get_file_with_leading_slashes_in_filename(http_controller, tmpdir, loop, project):