diff --git a/.gitignore b/.gitignore
index b6461f981f..89a87620b6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,3 +23,4 @@ trac/htdocs/js/messages/*.js
 .project
 .pydevproject
 .settings
+.DS_Store
diff --git a/trac/util/__init__.py b/trac/util/__init__.py
index f4804e01ba..9316124c86 100644
--- a/trac/util/__init__.py
+++ b/trac/util/__init__.py
@@ -575,7 +575,10 @@ def normalize(path):
         return os.path.normcase(os.path.abspath(path))
     path = normalize(path)
     parent = normalize(parent)
-    return path == parent or path.startswith(parent + os.sep)
+    try:
+        return os.path.commonpath((path, parent)) == parent
+    except ValueError:
+        return False
 
 
 class file_or_std(object):
diff --git a/trac/util/tests/__init__.py b/trac/util/tests/__init__.py
index 816ac1e5f1..a29b7b17ed 100644
--- a/trac/util/tests/__init__.py
+++ b/trac/util/tests/__init__.py
@@ -113,6 +113,17 @@ def test_is_path_below(self):
         self.assertFalse(util.is_path_below('../sub/repos',
                                             os.path.join(os.getcwd())))
 
+    def test_is_path_below_root_parent(self):
+        path = os.path.abspath(os.path.join(os.sep, 'tmp'))
+        self.assertTrue(util.is_path_below(path, os.sep))
+
+        if os.name == 'nt':
+            cwd = os.path.abspath(os.getcwd())
+            drive, _ = os.path.splitdrive(cwd)
+            drive_root = drive + os.sep
+            self.assertTrue(util.is_path_below(drive_root + 'tmp',
+                                               drive_root))
+
     def test_native_path(self):
         self.assertIsNone(util.native_path(None))
         if os.name == 'posix':