diff --git a/src/main/java/ch/digitalfondue/stampo/command/New.java b/src/main/java/ch/digitalfondue/stampo/command/New.java
index 4bf0b84..2e86c6d 100644
--- a/src/main/java/ch/digitalfondue/stampo/command/New.java
+++ b/src/main/java/ch/digitalfondue/stampo/command/New.java
@@ -128,6 +128,9 @@ public void run() {
 
   private void extractFile(Path outputPath, ZipEntry ze, InputStream zip) {
     Path destinationPath = outputPath.resolve(ze.getName());
+    if (!destinationPath.normalize().startsWith(outputPath.normalize())) {
+      throw new RuntimeException("Bad zip entry");
+    }
     try {
       Files.createDirectories(destinationPath.getParent());
       Files.copy(zip, destinationPath);