Using user input in file paths without sanitization allows directory traversal.
Use filepath.Clean() and verify the path is within the allowed base directory.