diff --git a/CHANGELOG.md b/CHANGELOG.md
index 665a257ac..40f4c9711 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [0.2.10](https://github.com/unjs/unstorage/compare/v0.2.9...v0.2.10) (2022-08-17)
+
+
+### Bug Fixes
+
+* **fs:** disallow keys containing `..` ([a4dd2cd](https://github.com/unjs/unstorage/commit/a4dd2cdefcfebc0bf76b11c588903a84c881dc9e))
+
 ### [0.2.9](https://github.com/unjs/unstorage/compare/v0.2.8...v0.2.9) (2021-10-06)
 
 
diff --git a/package.json b/package.json
index 6c36f9103..6482c5d64 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "unstorage",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "description": "Universal Storage Layer",
   "repository": "unjs/unstorage",
   "license": "MIT",
diff --git a/src/drivers/fs.ts b/src/drivers/fs.ts
index 68f0ef943..6e1539b1f 100644
--- a/src/drivers/fs.ts
+++ b/src/drivers/fs.ts
@@ -11,6 +11,8 @@ export interface FSStorageOptions {
   watchOptions?: WatchOptions
 }
 
+const PATH_TRAVERSE_RE = /\.\.\:|\.\.$/
+
 export default defineDriver((opts: FSStorageOptions = {}) => {
   if (!opts.base) {
     throw new Error('base is required')
@@ -24,7 +26,13 @@ export default defineDriver((opts: FSStorageOptions = {}) => {
   }
 
   opts.base = resolve(opts.base)
-  const r = (key: string) => join(opts.base!, key.replace(/:/g, '/'))
+  const r = (key: string) => {
+    if (PATH_TRAVERSE_RE.test(key)) {
+      throw new Error('[unstorage] [fs] Invalid key. It should not contain `..` segments: ' + key)
+    }
+    const resolved = join(opts.base!, key.replace(/:/g, '/'))
+    return resolved
+  }
 
   let _watcher: FSWatcher