diff --git a/plugins/scaffolder-backend/src/scaffolder/actions/builtin/publish/util.ts b/plugins/scaffolder-backend/src/scaffolder/actions/builtin/publish/util.ts
index dea180dc04..58ba5bfdd1 100644
--- a/plugins/scaffolder-backend/src/scaffolder/actions/builtin/publish/util.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/actions/builtin/publish/util.ts
@@ -15,6 +15,7 @@
  */
 
 import { InputError } from '@backstage/errors';
+import { isChildPath } from '@backstage/backend-common';
 import { join as joinPath, normalize as normalizePath } from 'path';
 import { ScmIntegrationRegistry } from '@backstage/integration';
 
@@ -27,7 +28,11 @@ export const getRepoSourceDirectory = (
       /^(\.\.(\/|\\|$))+/,
       '',
     );
-    return joinPath(workspacePath, safeSuffix);
+    const path = joinPath(workspacePath, safeSuffix);
+    if (!isChildPath(workspacePath, path)) {
+      throw new Error('Invalid source path');
+    }
+    return path;
   }
   return workspacePath;
 };