diff --git a/src/calibre/db/backend.py b/src/calibre/db/backend.py
index ef73a7334d..c1f6a876eb 100644
--- a/src/calibre/db/backend.py
+++ b/src/calibre/db/backend.py
@@ -2004,7 +2004,10 @@ class DB:
 
     def copy_extra_file_to(self, book_id, book_path, relpath, stream_or_path):
         full_book_path = os.path.abspath(os.path.join(self.library_path, book_path))
-        src_path = make_long_path_useable(os.path.join(full_book_path, relpath))
+        extra_file_path = os.path.abspath(os.path.join(full_book_path, relpath))
+        if not extra_file_path.startswith(full_book_path):
+            raise FileNotFoundError(f'No data file {relpath} in book: {book_id}')
+        src_path = make_long_path_useable(extra_file_path)
         if isinstance(stream_or_path, str):
             shutil.copy2(src_path, make_long_path_useable(stream_or_path))
         else: