diff --git a/tests/TenantAssetTest.php b/tests/TenantAssetTest.php
index 7f1b9ab0..3bd501de 100644
--- a/tests/TenantAssetTest.php
+++ b/tests/TenantAssetTest.php
@@ -298,6 +298,34 @@ test('tenant asset controller returns a 404 when accessing a nonexistent file',
     ]);
 });
 
+test('tenant asset controller throws an exception when accessing a file in a directory whose name starts with the name of the asset root', function () {
+    config([
+        'tenancy.identification.default_middleware' => InitializeTenancyByRequestData::class,
+        // Disk used for serving the assets -- its root is 'app/media' in the tenant's storage directory
+        'filesystems.disks.media' => ['driver' => 'local', 'root' => storage_path('app/media')],
+        'tenancy.filesystem.disks' => array_merge(config('tenancy.filesystem.disks'), ['media']),
+        'tenancy.filesystem.root_override.media' => '%storage_path%/app/media/',
+    ]);
+
+    TenantAssetController::$publicDisk = 'media';
+
+    $tenant = Tenant::create();
+    tenancy()->initialize($tenant);
+
+    Storage::disk('media')->put('photo.jpg', 'public file');
+
+    // A directory next to the asset root, e.g. one holding files that shouldn't be served
+    mkdir($privateDirectory = storage_path('app/media-originals'), recursive: true);
+    file_put_contents($privateDirectory . '/photo.jpg', 'private file');
+
+    $this->withoutExceptionHandling();
+    pest()->expectExceptionMessage('Accessing a file outside the storage root'); // outside tests this is a 404
+
+    pest()->get(tenant_asset('../media-originals/photo.jpg'), [
+        'X-Tenant' => $tenant->id,
+    ]);
+});
+
 test('test asset controller returns a 404 when accessing a file outside the storage root', function () {
     config(['tenancy.identification.default_middleware' => InitializeTenancyByRequestData::class]);