diff --git a/engine-rest/src/main/java/io/nosqlbench/engine/rest/services/WorkSpace.java b/engine-rest/src/main/java/io/nosqlbench/engine/rest/services/WorkSpace.java
index 7f9b444c5..572511741 100644
--- a/engine-rest/src/main/java/io/nosqlbench/engine/rest/services/WorkSpace.java
+++ b/engine-rest/src/main/java/io/nosqlbench/engine/rest/services/WorkSpace.java
@@ -151,6 +151,9 @@ public class WorkSpace {
     }
 
     private void assertLegalWorkspacePath(Path target) {
+        if (!target.normalize().startsWith(this.workspacePath)) {
+            throw new RuntimeException("workspace path '" + target + "' contains path traversal");
+        }
         if (target.toString().contains("..")) {
             throw new RuntimeException("Possible path injection:" + target);
         }