diff --git a/server/assets.go b/server/assets.go
index d46848c2..15dea62f 100644
--- a/server/assets.go
+++ b/server/assets.go
@@ -6,6 +6,7 @@ import (
 	"mime/multipart"
 	"net/http"
 	"os"
+	"path"
 	"path/filepath"
 	"strconv"
 	"time"
@@ -62,8 +63,11 @@ func serveImages(w http.ResponseWriter, r *http.Request) {
 	http.ServeContent(w, r, path, time.Time{}, file)
 }
 
+// Join a request path onto a served directory. The request path is rooted at
+// "/" before cleaning, so ".." can never climb above the directory
+// (same approach as net/http.Dir).
 func cleanJoin(a, b string) string {
-	return filepath.Clean(filepath.Join(a, b))
+	return filepath.Join(a, filepath.FromSlash(path.Clean("/"+b)))
 }
 
 // Server static assets