diff --git a/src/media/server.test.ts b/src/media/server.test.ts
index 876051dcd..c30e6ea61 100644
--- a/src/media/server.test.ts
+++ b/src/media/server.test.ts
@@ -49,4 +49,14 @@ describe("media server", () => {
     await expect(fs.stat(file)).rejects.toThrow();
     await new Promise((r) => server.close(r));
   });
+
+  it("blocks path traversal attempts", async () => {
+    const server = await startMediaServer(0, 5_000);
+    const port = (server.address() as AddressInfo).port;
+    // URL-encoded "../" to bypass client-side path normalization
+    const res = await fetch(`http://localhost:${port}/media/%2e%2e%2fpackage.json`);
+    expect(res.status).toBe(400);
+    expect(await res.text()).toBe("invalid path");
+    await new Promise((r) => server.close(r));
+  });
 });
diff --git a/src/media/server.ts b/src/media/server.ts
index 52c5a1ec3..27c2d5ed9 100644
--- a/src/media/server.ts
+++ b/src/media/server.ts
@@ -17,7 +17,12 @@ export function attachMediaRoutes(
 
   app.get("/media/:id", async (req, res) => {
     const id = req.params.id;
-    const file = path.join(mediaDir, id);
+    const file = path.resolve(mediaDir, id);
+    const mediaRoot = path.resolve(mediaDir) + path.sep;
+    if (!file.startsWith(mediaRoot)) {
+      res.status(400).send("invalid path");
+      return;
+    }
     try {
       const stat = await fs.stat(file);
       if (Date.now() - stat.mtimeMs > ttlMs) {