Language: Python
Label: vulnerable
CWE: CWE-23 \u2014 Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Code:
    def change_version(self, new_version: str, dry: bool):

        changelog = CHANGELOG.read_text(encoding="utf-8")
        if new_version not in changelog:
            raise Exception(
                (
                    f"{new_version} is absent in CHANGELOG.md file."
                    f" Please update the changelog first."
                ).format(new_version=new_version)
            )

        for location in self.locations:
            replace_version(
                path=location.path,
                template=location.template,
                old=self.current_version,
                new=new_version,
                dry=dry,
            )