I have created a simple blog using express.js with ejs as a render engine. My blog posts are contained in a directory: views/posts/first-post.ejs, views/posts/second-post.ejs etc.

I'm serving the files like this:

router.get("/:post", (req, res, next) => {
  const { post } = req.params;

  if (post && fs.readdirSync("views/posts").includes(`${post}.ejs`)) {
    return res.render(`posts/${post}`);
  } else {
    return next(createError(404));
  }
});

I'm worried there might be a risk of of LFI (local file inclusion). Do you think this is fine? And if not, what would you do differently?