CVE-2026-68549
CVE-2026-68549 · ClickMigrate has Path Traversal in "revision -m" argument
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
### Impact A path traversal vulnerability in the `revision` command allowed a crafted migration name supplied via the `-m` argument to escape the intended migrations directory. Under specific conditions, an attacker could cause the tool to create a `.sql` file in an arbitrary location writable by the user executing the command. This issue is only exploitable if an attacker can influence the migration name passed to the `revision` command, such as through an insecure automation or CI/CD pipeline that forwards untrusted input. ### Patches The vulnerability has been fixed in version 1.0.3 by validating and sanitizing the migration name to prevent directory traversal. Users should upgrade to version 1.0.3 or later. ### Workarounds Do not pass untrusted input to the `revision -m` argument. If upgrading is not immediately possible, ensure that only trusted users or automation can invoke the `revision` command and that migration names are validated before being passed to the tool. ### References - Fix commit: https://github.com/QueueForge/ClickMigrate/commit/6b1f2c0202630a82252b3331aa57e64327e112b6
CVSS 3.3 · Niedrig · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: python
Betroffene Produkte und Versionen
clickmigrate PyPI
- Softwareversionen
- 1.0.0
- Betroffene Versionsbereiche
- ECOSYSTEM: < 1.0.3
Auf 1.0.3 aktualisieren