Skip to content
Fencer Vulns
low 3.3

CVE-2026-68549 json

ClickMigrate has Path Traversal in "revision -m" argument

published 2026-10-16 23 d ago modified 2026-10-16 23 d ago also GHSA-vgf9-9mxx-hq54

cvss
3.3
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

### Impact A path traversal vulnerability in the `revision` command allowed a crafted migration name supplied via the `-m` argument to escape the intended migrations directory.

Under specific conditions, an attacker could cause the tool to create a `.sql` file in an arbitrary location writable by the user executing the command.

This issue is only exploitable if an attacker can influence the migration name passed to the `revision` command, such as through an insecure automation or CI/CD pipeline that forwards untrusted input.

### Patches The vulnerability has been fixed in version 1.0.3 by validating and sanitizing the migration name to prevent directory traversal.

Users should upgrade to version 1.0.3 or later.

### Workarounds Do not pass untrusted input to the `revision -m` argument.

If upgrading is not immediately possible, ensure that only trusted users or automation can invoke the `revision` command and that migration names are validated before being passed to the tool.

### References - Fix commit: https://github.com/QueueForge/ClickMigrate/commit/6b1f2c0202630a82252b3331aa57e64327e112b6

Patch / fix

  • pypi clickmigrate 1.0.3

CVSS scores

assigned by version score vector
GitHub 3.1 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
pypi clickmigrate
<1.0.3
1.0.3

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.