diff --git a/src/main/java/meteordevelopment/meteorclient/gui/tabs/builtin/ProfilesTab.java b/src/main/java/meteordevelopment/meteorclient/gui/tabs/builtin/ProfilesTab.java
index 175fb85e3f..80b1c6365e 100644
--- a/src/main/java/meteordevelopment/meteorclient/gui/tabs/builtin/ProfilesTab.java
+++ b/src/main/java/meteordevelopment/meteorclient/gui/tabs/builtin/ProfilesTab.java
@@ -148,14 +148,17 @@ private Profile importProfile() throws IOException {
             CompoundTag nbt = NbtIo.read(profileFile.toPath());
 
             Profile p = new Profile();
-            p.name.set(nbt.getStringOr("name", profileFile.getName()));
+            if (!p.name.set(nbt.getStringOr("name", profileFile.getName()))) return null;
+            File profileFolder = p.getSafeFile();
+            if (profileFolder == null) return null;
             //noinspection ResultOfMethodCallIgnored
-            p.getFile().mkdirs();
+            profileFolder.mkdirs();
 
             nbt.remove("name");
             for (var entry : nbt.entrySet()) {
                 String filename = entry.getKey();
                 if (!filename.endsWith(".nbt")) continue;
+                if (filename.contains("/") || filename.contains("\\") || new File(filename).isAbsolute()) continue;
 
                 switch (filename) {
                     case "hud.nbt" -> p.hud.set(true);
@@ -166,8 +169,8 @@ private Profile importProfile() throws IOException {
                     }
                 }
 
-                File f = new File(p.getFile(), filename).getCanonicalFile();
-                if (!f.toPath().startsWith(Profiles.FOLDER.getCanonicalFile().toPath())) continue;
+                File f = new File(profileFolder, filename).getCanonicalFile();
+                if (!f.toPath().startsWith(profileFolder.toPath())) continue;
 
                 NbtIo.writeUnnamedTagWithFallback(entry.getValue(), new DataOutputStream(new FileOutputStream(f)));
             }
@@ -212,7 +215,7 @@ public void initWidgets() {
 
             WButton save = add(theme.button(isNew ? "Create" : "Save")).expandX().widget();
             save.action = () -> {
-                if (profile.name.get().isEmpty()) return;
+                if (profile.getSafeFile() == null) return;
 
                 if (isNew) {
                     for (Profile p : Profiles.get()) {
diff --git a/src/main/java/meteordevelopment/meteorclient/systems/profiles/Profile.java b/src/main/java/meteordevelopment/meteorclient/systems/profiles/Profile.java
index 59e210b5bc..2b43e0e81b 100644
--- a/src/main/java/meteordevelopment/meteorclient/systems/profiles/Profile.java
+++ b/src/main/java/meteordevelopment/meteorclient/systems/profiles/Profile.java
@@ -78,7 +78,8 @@ public Profile(Tag tag) {
     }
 
     public void load() {
-        File folder = getFile();
+        File folder = getSafeFile();
+        if (folder == null) return;
 
         if (hud.get()) Hud.get().load(folder);
         if (macros.get()) Macros.get().load(folder);
@@ -87,7 +88,8 @@ public void load() {
     }
 
     public void save() {
-        File folder = getFile();
+        File folder = getSafeFile();
+        if (folder == null) return;
 
         if (hud.get()) Hud.get().save(folder);
         if (macros.get()) Macros.get().save(folder);
@@ -97,7 +99,8 @@ public void save() {
 
     public void delete() {
         try {
-            FileUtils.deleteDirectory(getFile());
+            File folder = getSafeFile();
+            if (folder != null) FileUtils.deleteDirectory(folder);
         } catch (IOException e) {
             MeteorClient.LOG.error("Error deleting profile {}", name.get(), e);
         }
@@ -107,6 +110,20 @@ public File getFile() {
         return new File(Profiles.FOLDER, name.get());
     }
 
+    public File getSafeFile() {
+        try {
+            File folder = getFile().getCanonicalFile();
+            File profilesFolder = Profiles.FOLDER.getCanonicalFile();
+
+            if (name.get().isEmpty() || !profilesFolder.equals(folder.getParentFile())) return null;
+
+            return folder;
+        } catch (IOException e) {
+            MeteorClient.LOG.error("Error resolving profile {}", name.get(), e);
+            return null;
+        }
+    }
+
     @Override
     public CompoundTag toTag() {
         CompoundTag tag = new CompoundTag();