Path traversal in rebar3 via unvalidated dependency app names

{
                    "cpes": [
                        "cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "rebar_packages",
                        "rebar_app_utils",
                        "rebar_fetch"
                    ],
                    "packageName": "rebar3",
                    "packageURL": "pkg:otp/rebar3?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Frebar3&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Frebar3.git",
                    "product": "rebar3",
                    "programFiles": [
                        "apps/rebar/src/rebar_packages.erl",
                        "apps/rebar/src/rebar_app_utils.erl",
                        "apps/rebar/src/rebar_fetch.erl"
                    ],
                    "programRoutines": [
                        {
                            "name": "rebar_packages:parse_deps/1"
                        },
                        {
                            "name": "rebar_app_utils:dep_to_app/7"
                        },
                        {
                            "name": "rebar_fetch:download_source/2"
                        },
                        {
                            "name": "rebar_fetch:download_source_online/2"
                        }
                    ],
                    "repo": "https://github.com/erlang/rebar3",
                    "vendor": "erlang",
                    "versions": [
                        {
                            "lessThan": "3.27.2",
                            "status": "affected",
                            "version": "3.7.0-rc1",
                            "versionType": "semver"
                        }
                    ]
                }

{
                    "collectionURL": "https://github.com",
                    "cpes": [
                        "cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "rebar_packages",
                        "rebar_app_utils",
                        "rebar_fetch"
                    ],
                    "packageName": "erlang/rebar3",
                    "packageURL": "pkg:github/erlang/rebar3",
                    "product": "rebar3",
                    "programFiles": [
                        "apps/rebar/src/rebar_packages.erl",
                        "apps/rebar/src/rebar_app_utils.erl",
                        "apps/rebar/src/rebar_fetch.erl"
                    ],
                    "programRoutines": [
                        {
                            "name": "rebar_packages:parse_deps/1"
                        },
                        {
                            "name": "rebar_app_utils:dep_to_app/7"
                        },
                        {
                            "name": "rebar_fetch:download_source/2"
                        },
                        {
                            "name": "rebar_fetch:download_source_online/2"
                        }
                    ],
                    "repo": "https://github.com/erlang/rebar3",
                    "vendor": "erlang",
                    "versions": [
                        {
                            "lessThan": "e35282b26e499b1d9e8f30bba9dccd71cd8b02ba",
                            "status": "affected",
                            "version": "56b7d88975aa8da6446857cfd92de0825024bf63",
                            "versionType": "git"
                        }
                    ]
                }