Fix code scanning alert no. 1: Uncontrolled data used in path expression

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

src/utils/load.py

@@ -38,7 +38,10 @@ def _load_template(stem: Template) -> DotTemplate:
     try:
         return DotTemplate.read(glob()[stem])
     except KeyError:
-        if (root / stem).is_dir():
+        fullpath = (root / stem).resolve()
+        if not str(fullpath).startswith(str(root.resolve())):
+            raise Exception("Access to the path is not allowed")
+        if fullpath.is_dir():
             return getattr(components, stem)
         raise