diff --git a/tools/goctl/util/zipx/zipx.go b/tools/goctl/util/zipx/zipx.go
index 0071150d1b3a..e41d42d8774b 100644
--- a/tools/goctl/util/zipx/zipx.go
+++ b/tools/goctl/util/zipx/zipx.go
@@ -2,9 +2,11 @@ package zipx
 
 import (
 	"archive/zip"
+	"fmt"
 	"io"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"github.com/zeromicro/go-zero/tools/goctl/util/pathx"
 )
@@ -39,6 +41,12 @@ func fileCopy(file *zip.File, destPath string) error {
 		return err
 	}
 	defer rc.Close()
+
+	// Ensure the file path does not contain directory traversal elements
+	if strings.Contains(file.Name, "..") {
+		return fmt.Errorf("invalid file path: %s", file.Name)
+	}
+
 	abs, err := filepath.Abs(file.Name)
 	if err != nil {
 		return err