Opening a format!-built path can escape the intended directory (../).
Canonicalize the path and verify it stays within an allowed base directory.