CVE-2026-68549
CVE-2026-68549 · ClickMigrate has Path Traversal in "revision -m" argument
This page contains facts from public vulnerability sources. Check the original advisory before updating.
### Impact A path traversal vulnerability in the `revision` command allowed a crafted migration name supplied via the `-m` argument to escape the intended migrations directory. Under specific conditions, an attacker could cause the tool to create a `.sql` file in an arbitrary location writable by the user executing the command. This issue is only exploitable if an attacker can influence the migration name passed to the `revision` command, such as through an insecure automation or CI/CD pipeline that forwards untrusted input. ### Patches The vulnerability has been fixed in version 1.0.3 by validating and sanitizing the migration name to prevent directory traversal. Users should upgrade to version 1.0.3 or later. ### Workarounds Do not pass untrusted input to the `revision -m` argument. If upgrading is not immediately possible, ensure that only trusted users or automation can invoke the `revision` command and that migration names are validated before being passed to the tool. ### References - Fix commit: https://github.com/QueueForge/ClickMigrate/commit/6b1f2c0202630a82252b3331aa57e64327e112b6
CVSS 3.3 · Low · Fix available
- Published
- Updated
Stack: python
Affected products and versions
clickmigrate PyPI
- Versions
- 1.0.0
- Affected ranges
- ECOSYSTEM: < 1.0.3
Update to 1.0.3