diff --git a/modules/app_video.py b/modules/app_video.py
index 6c29d85..7b6a3e0 100644
--- a/modules/app_video.py
+++ b/modules/app_video.py
@@ -46,7 +46,7 @@ def _convert_bg(relative_path):
     try:
         source_path = _local_path(relative_path)
         mp4_relative = os.path.splitext(relative_path)[0] + ".mp4"
-        mp4_path = _local_path(mp4_relative)
+        mp4_path = _local_path_unchecked(mp4_relative)
 
         if not app_dash.begin_local_video_use(relative_path):
             return
@@ -96,6 +96,15 @@ def _local_path(relative_path):
     return app_dash.safe_video_path(app_dash.DEFAULT_DESTINATION, relative_path)
 
 
+def _local_path_unchecked(relative_path):
+    """Build absolute path without requiring the file to already exist."""
+    base = os.path.realpath(app_dash.DEFAULT_DESTINATION)
+    target = os.path.realpath(os.path.join(base, relative_path))
+    if os.path.commonpath([base, target]) != base:
+        raise ValueError("Path escapes video directory.")
+    return target
+
+
 def _thumbnail_path(relative_path):
     source_root = os.path.realpath(app_dash.DEFAULT_DESTINATION)
     source_path = app_dash.safe_video_path(source_root, relative_path)