diff --git a/pkg/cli/add_package_manifest.go b/pkg/cli/add_package_manifest.go
index 19b33049289..0886ee0ae51 100644
--- a/pkg/cli/add_package_manifest.go
+++ b/pkg/cli/add_package_manifest.go
@@ -576,7 +576,7 @@ func parseManifestIncludeMapping(mapping map[string]any, manifestPath string) (r
 // paths that escape their root.
 func cleanManifestRelativePath(p string) (string, error) {
 	slashed := filepath.ToSlash(p)
-	if strings.HasPrefix(slashed, "/") || strings.HasPrefix(slashed, "\\") || filepath.IsAbs(p) || isWindowsDriveRelativePath(slashed) {
+	if len(slashed) > 0 && (slashed[0] == '/' || slashed[0] == '\\') || filepath.IsAbs(p) || isWindowsDriveRelativePath(slashed) {
 		return "", errors.New("absolute paths are not allowed")
 	}
 	cleaned := path.Clean(slashed)
diff --git a/pkg/cli/add_package_manifest_mapping_test.go b/pkg/cli/add_package_manifest_mapping_test.go
index 425f9d3f22b..52254a14489 100644
--- a/pkg/cli/add_package_manifest_mapping_test.go
+++ b/pkg/cli/add_package_manifest_mapping_test.go
@@ -13,6 +13,18 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestCleanManifestRelativePathRejectsAbsoluteForms(t *testing.T) {
+	t.Parallel()
+
+	for _, input := range []string{"/tmp/reviewer.md", `\tmp\reviewer.md`, `C:/tmp/reviewer.md`} {
+		t.Run(input, func(t *testing.T) {
+			t.Parallel()
+			_, err := cleanManifestRelativePath(input)
+			assert.EqualError(t, err, "absolute paths are not allowed")
+		})
+	}
+}
+
 // setupMappingPackageTest wires the package resolution hooks so that only the manifest and
 // README of a package are available, and auto-scan is disabled.
 func setupMappingPackageTest(t *testing.T, manifest map[string]string) {