diff --git a/src/commands/app/create.ts b/src/commands/app/create.ts
index 048ae66..5dc862b 100644
--- a/src/commands/app/create.ts
+++ b/src/commands/app/create.ts
@@ -232,7 +232,7 @@ export default class Create extends BaseCommand<typeof Create> {
     // Get the directory inside the zip file
     const zipEntries = zip.getEntries();
     const firstEntry = zipEntries[0];
-    const sourcePath = resolve(dataDir, firstEntry.entryName.split("/")[0]);
+    const sourcePath = resolve(sanitizePath(dataDir), sanitizePath(firstEntry.entryName.split("/")[0]));
 
     if (this.flags["data-dir"] && !existsSync(this.flags["data-dir"])) {
       mkdirSync(this.flags["data-dir"], { recursive: true });