diff --git a/pkg/api/short_url.go b/pkg/api/short_url.go
index b894a649fe7..ab131e9fd6f 100644
--- a/pkg/api/short_url.go
+++ b/pkg/api/short_url.go
@@ -23,6 +23,10 @@ func (hs *HTTPServer) createShortURL(c *models.ReqContext, cmd dtos.CreateShortU
 		hs.log.Error("Invalid short URL path", "path", cmd.Path)
 		return response.Error(400, "Path should be relative", nil)
 	}
+	if strings.Contains(cmd.Path, "../") {
+		hs.log.Error("Invalid short URL path", "path", cmd.Path)
+		return response.Error(400, "Invalid path", nil)
+	}
 
 	shortURL, err := hs.ShortURLService.CreateShortURL(c.Req.Context(), c.SignedInUser, cmd.Path)
 	if err != nil {