diff --git a/CHANGELOG b/CHANGELOG
index 34182b9c0e..f526b4b4bf 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,4 @@
+* Use safe_join in SharedDataMiddlewareIndex (issue10068)
 * Use menu name for window opened from menu
 * Add trigonometric functions to sqlite backend
 * Allow skipping user warnings globally
diff --git a/trytond/wsgi.py b/trytond/wsgi.py
index 893027eb41..01c3bb608f 100644
--- a/trytond/wsgi.py
+++ b/trytond/wsgi.py
@@ -4,6 +4,7 @@ import base64
 import http.client
 import logging
 import os
+import posixpath
 import sys
 import traceback
 import urllib.parse
@@ -24,6 +25,10 @@ try:
             x_port=num_proxies, x_prefix=num_proxies)
 except ImportError:
     from werkzeug.contrib.fixers import ProxyFix as NumProxyFix
+try:
+    from werkzeug.security import safe_join
+except ImportError:
+    safe_join = posixpath.join
 try:
     from werkzeug.middleware.shared_data import SharedDataMiddleware
 except ImportError:
@@ -201,13 +206,14 @@ class SharedDataMiddlewareIndex(SharedDataMiddleware):
     def get_directory_loader(self, directory):
         def loader(path):
             if path is not None:
-                path = os.path.join(directory, path)
+                path = safe_join(directory, path)
             else:
                 path = directory
-            if os.path.isdir(path):
-                path = os.path.join(path, 'index.html')
-            if os.path.isfile(path):
-                return os.path.basename(path), self._opener(path)
+            if path is not None:
+                if os.path.isdir(path):
+                    path = posixpath.join(path, 'index.html')
+                if os.path.isfile(path):
+                    return os.path.basename(path), self._opener(path)
             return None, None
         return loader