diff --git a/backend/src/hatchling/metadata/core.py b/backend/src/hatchling/metadata/core.py
index 44dea4686..fb1a3cdbc 100644
--- a/backend/src/hatchling/metadata/core.py
+++ b/backend/src/hatchling/metadata/core.py
@@ -528,6 +528,9 @@ def readme(self) -> str:
                     raise TypeError(message)
 
                 readme_path = os.path.normpath(os.path.join(self.root, readme))
+                if os.path.isabs(readme) or os.path.relpath(readme_path, self.root).startswith(".."):
+                    message = f"Readme path must be within the project directory: {readme}"
+                    raise ValueError(message)
                 if not os.path.isfile(readme_path):
                     message = f"Readme file does not exist: {readme}"
                     raise OSError(message)
@@ -565,6 +568,9 @@ def readme(self) -> str:
                         raise TypeError(message)
 
                     path = os.path.normpath(os.path.join(self.root, relative_path))
+                    if os.path.isabs(relative_path) or os.path.relpath(path, self.root).startswith(".."):
+                        message = f"Readme path must be within the project directory: {relative_path}"
+                        raise ValueError(message)
                     if not os.path.isfile(path):
                         message = f"Readme file does not exist: {relative_path}"
                         raise OSError(message)