diff --git a/.changeset/stale-poets-destroy.md b/.changeset/stale-poets-destroy.md
deleted file mode 100644
index 71f8a478ec..0000000000
--- a/.changeset/stale-poets-destroy.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-'@backstage/plugin-scaffolder-backend': patch
----
-
-Make sure `sourcePath` of `publish:github:pull-request` can only be used to
-retrieve files from the workspace.
diff --git a/plugins/scaffolder-backend/CHANGELOG.md b/plugins/scaffolder-backend/CHANGELOG.md
index 413c384929..160a0229d5 100644
--- a/plugins/scaffolder-backend/CHANGELOG.md
+++ b/plugins/scaffolder-backend/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @backstage/plugin-scaffolder-backend
 
+## 0.15.9
+
+### Patch Changes
+
+- 0f99f1170e: Make sure `sourcePath` of `publish:github:pull-request` can only be used to
+  retrieve files from the workspace.
+
 ## 0.15.8
 
 ### Patch Changes
diff --git a/plugins/scaffolder-backend/package.json b/plugins/scaffolder-backend/package.json
index 15f4cd40d2..05377123c0 100644
--- a/plugins/scaffolder-backend/package.json
+++ b/plugins/scaffolder-backend/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@backstage/plugin-scaffolder-backend",
   "description": "The Backstage backend plugin that helps you create new things",
-  "version": "0.15.8",
+  "version": "0.15.9",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "license": "Apache-2.0",
diff --git a/plugins/scaffolder-backend/src/scaffolder/actions/builtin/publish/util.ts b/plugins/scaffolder-backend/src/scaffolder/actions/builtin/publish/util.ts
index dea180dc04..58ba5bfdd1 100644
--- a/plugins/scaffolder-backend/src/scaffolder/actions/builtin/publish/util.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/actions/builtin/publish/util.ts
@@ -15,6 +15,7 @@
  */
 
 import { InputError } from '@backstage/errors';
+import { isChildPath } from '@backstage/backend-common';
 import { join as joinPath, normalize as normalizePath } from 'path';
 import { ScmIntegrationRegistry } from '@backstage/integration';
 
@@ -27,7 +28,11 @@ export const getRepoSourceDirectory = (
       /^(\.\.(\/|\\|$))+/,
       '',
     );
-    return joinPath(workspacePath, safeSuffix);
+    const path = joinPath(workspacePath, safeSuffix);
+    if (!isChildPath(workspacePath, path)) {
+      throw new Error('Invalid source path');
+    }
+    return path;
   }
   return workspacePath;
 };