diff --git a/js/server/modules/@arangodb/foxx/legacy/swagger.js b/js/server/modules/@arangodb/foxx/legacy/swagger.js
index ccf0e7fbbb..848ed5d2d3 100644
--- a/js/server/modules/@arangodb/foxx/legacy/swagger.js
+++ b/js/server/modules/@arangodb/foxx/legacy/swagger.js
@@ -25,6 +25,7 @@
 var _ = require('lodash');
 var fs = require('fs');
 var joinPath = require('path').join;
+var resolvePath = require('path').resolve;
 var internal = require('internal');
 var ArangoError = require('@arangodb').ArangoError;
 var errors = require('@arangodb').errors;
@@ -93,12 +94,10 @@ function createSwaggerRouteHandler (defaultAppPath, opts) {
 }
 
 function swaggerPath (path, basePath) {
-  if (path.charAt(0) === '/') {
-    return path;
-  }
   if (!basePath) {
     basePath = joinPath(internal.startupPath, 'server', 'assets', 'swagger');
   }
+  path = resolvePath('/', path);
   return joinPath(basePath, path);
 }
 
diff --git a/js/server/modules/@arangodb/foxx/swagger.js b/js/server/modules/@arangodb/foxx/swagger.js
index 694240af42..4fcadc7042 100644
--- a/js/server/modules/@arangodb/foxx/swagger.js
+++ b/js/server/modules/@arangodb/foxx/swagger.js
@@ -25,6 +25,7 @@
 const NotFound = require('http-errors').NotFound;
 const fs = require('fs');
 const joinPath = require('path').join;
+const resolvePath = require('path').resolve;
 const internal = require('internal');
 const errors = require('@arangodb').errors;
 const FoxxManager = require('@arangodb/foxx/manager');
@@ -101,7 +102,8 @@ module.exports = function createSwaggerRouteHandler (foxxMount, opts) {
     } else if (path === 'index.html') {
       path = indexFile;
     }
-    const filePath = path.charAt(0) === '/' ? path : joinPath(swaggerRoot, path);
+    path = resolvePath('/', path);
+    const filePath = joinPath(swaggerRoot, path);
     if (!fs.isFile(filePath)) {
       throw new NotFound(`unknown path "${req._raw.url}"`);
     }