diff --git a/index.js b/index.js
index 6105029b3..28e874969 100644
--- a/index.js
+++ b/index.js
@@ -22,8 +22,9 @@ const UID = process.env.AUDIOBOOKSHELF_UID || 99
 const GID = process.env.AUDIOBOOKSHELF_GID || 100
 const SOURCE = process.env.SOURCE || 'docker'
 const ROUTER_BASE_PATH = process.env.ROUTER_BASE_PATH || ''
+const MEDIA_BASE_PATH = process.env.MEDIA_BASE_PATH || ''
 
 console.log('Config', CONFIG_PATH, METADATA_PATH)
 
-const Server = new server(SOURCE, PORT, HOST, UID, GID, CONFIG_PATH, METADATA_PATH, ROUTER_BASE_PATH)
+const Server = new server(SOURCE, PORT, HOST, UID, GID, CONFIG_PATH, METADATA_PATH, ROUTER_BASE_PATH, MEDIA_BASE_PATH)
 Server.start()
diff --git a/server/Server.js b/server/Server.js
index 3b9223da7..e330c8654 100644
--- a/server/Server.js
+++ b/server/Server.js
@@ -38,7 +38,7 @@ const TaskManager = require('./managers/TaskManager')
 const EBookManager = require('./managers/EBookManager')
 
 class Server {
-  constructor(SOURCE, PORT, HOST, UID, GID, CONFIG_PATH, METADATA_PATH, ROUTER_BASE_PATH) {
+  constructor(SOURCE, PORT, HOST, UID, GID, CONFIG_PATH, METADATA_PATH, ROUTER_BASE_PATH, MEDIA_BASE_PATH) {
     this.Port = PORT
     this.Host = HOST
     global.Source = SOURCE
@@ -48,6 +48,7 @@ class Server {
     global.ConfigPath = fileUtils.filePathToPOSIX(Path.normalize(CONFIG_PATH))
     global.MetadataPath = fileUtils.filePathToPOSIX(Path.normalize(METADATA_PATH))
     global.RouterBasePath = ROUTER_BASE_PATH
+    global.MediaBasePath = MEDIA_BASE_PATH
 
     if (!fs.pathExistsSync(global.ConfigPath)) {
       fs.mkdirSync(global.ConfigPath)
diff --git a/server/controllers/LibraryController.js b/server/controllers/LibraryController.js
index 28b61099e..69cc85f27 100644
--- a/server/controllers/LibraryController.js
+++ b/server/controllers/LibraryController.js
@@ -27,15 +27,20 @@ class LibraryController {
       return f
     })
     for (const folder of newLibraryPayload.folders) {
+      const path = folder.fullPath
+      if (!path.startsWith(global.MediaBasePath)) {
+        Logger.warn(`${path} is not in media base directory`)
+        return res.status(400).send(`${path} is not in media base directory`)
+      }
       try {
-        const direxists = await fs.pathExists(folder.fullPath)
+        const direxists = await fs.pathExists(path)
         if (!direxists) { // If folder does not exist try to make it and set file permissions/owner
-          await fs.mkdir(folder.fullPath)
-          await filePerms.setDefault(folder.fullPath)
+          await fs.mkdir(path)
+          await filePerms.setDefault(path)
         }
       } catch (error) {
-        Logger.error(`[LibraryController] Failed to ensure folder dir "${folder.fullPath}"`, error)
-        return res.status(400).send(`Invalid folder directory "${folder.fullPath}"`)
+        Logger.error(`Failed to ensure folder dir "${path}"`, error)
+        return res.status(400).send(`Invalid folder directory "${path}"`)
       }
     }
 
@@ -97,6 +102,10 @@ class LibraryController {
         return f
       })
       for (const path of newFolderPaths) {
+        if (!path.startsWith(global.MediaBasePath)) {
+          Logger.warn(`${path} is not in media base directory`)
+          return res.status(400).send(`${path} is not in media base directory`)
+        }
         const pathExists = await fs.pathExists(path)
         if (!pathExists) {
           // Ensure dir will recursively create directories which might be preferred over mkdir