{"id":"CVE-2026-68549","kind":"vulnerability","aliases":["CVE-2026-68549","GHSA-vgf9-9mxx-hq54"],"related":[],"title":"ClickMigrate has Path Traversal in \"revision -m\" argument","description":"### Impact\nA path traversal vulnerability in the `revision` command allowed a crafted migration name supplied via the `-m` argument to escape the intended migrations directory.\n\nUnder specific conditions, an attacker could cause the tool to create a `.sql` file in an arbitrary location writable by the user executing the command.\n\nThis issue is only exploitable if an attacker can influence the migration name passed to the `revision` command, such as through an insecure automation or CI/CD pipeline that forwards untrusted input.\n\n### Patches\nThe vulnerability has been fixed in version 1.0.3 by validating and sanitizing the migration name to prevent directory traversal.\n\nUsers should upgrade to version 1.0.3 or later.\n\n### Workarounds\nDo not pass untrusted input to the `revision -m` argument.\n\nIf upgrading is not immediately possible, ensure that only trusted users or automation can invoke the `revision` command and that migration names are validated before being passed to the tool.\n\n### References\n- Fix commit: https://github.com/QueueForge/ClickMigrate/commit/6b1f2c0202630a82252b3331aa57e64327e112b6","summary":"ClickMigrate's revision command let a crafted migration name passed via -m escape the migrations directory. An attacker who controls that input can make the tool write a .sql file to any location the running user can write to.","severity":"low","cvss":3.299999952316284,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ClickMigrate","fixed":["1.0.3"],"affected":"< 1.0.3","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ci-cd","clickmigrate","cwe-22","package","python"],"not_affected_if":["default-config","no-untrusted-migration-names"],"how_to_check":"Run pip show ClickMigrate and check whether the version is below 1.0.3.\nSearch CI/CD scripts for 'revision -m' to see whether any untrusted input reaches it.","fix":"Upgrade ClickMigrate to 1.0.3 or later.\nUntil then, do not pass untrusted input to revision -m and validate migration names before calling the tool.","status":"open","published_at":"2026-10-16T19:17:28+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:03:34+00:00","updated_at":"2026-10-23T20:03:34+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T20:03:34Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade ClickMigrate to 1.0.3 or later.\nUntil then, do not pass untrusted input to revision -m and validate migration names before calling the tool.","summary":"ClickMigrate's revision command let a crafted migration name passed via -m escape the migrations directory. An attacker who controls that input can make the tool write a .sql file to any location the running user can write to.","category":"package","who_cares":["clickmigrate","python","ci-cd"],"confidence":0.8,"analyst_note":"","how_to_check":"Run pip show ClickMigrate and check whether the version is below 1.0.3.\nSearch CI/CD scripts for 'revision -m' to see whether any untrusted input reaches it.","needs_analyst":false,"not_affected_if":["default-config","no-untrusted-migration-names"],"severity_if_unknown":"low"},"cost_usd":0.000382,"input_tokens":2332,"output_tokens":298,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,18A '-22':26B '-68549':11A,19A '/queueforge/clickmigrate/commit/6b1f2c0202630a82252b3331aa57e64327e112b6':222C '1.0.3':156C,173C '9mxx':15A 'allow':76C 'arbitrari':108C 'argument':8A,85C,186C 'attack':46B,96C,124C 'autom':140C,199C 'caus':98C 'cd':23B 'ci':22B 'ci-cd':21B 'ci/cd':142C 'clickmigr':1A,24B,29B 'clickmigrate':20A 'command':32B,75C,116C,134C,204C 'commit':219C 'condit':94C 'control':48B 'could':97C 'craft':35B,78C 'creat':102C 'cve':9A,17A 'cwe':25B 'directori':44B,91C,166C 'ensur':193C 'escap':41B,87C 'execut':114C 'exploit':121C 'file':58B,105C 'fix':153C,218C 'forward':145C 'ghsa':13A 'ghsa-vgf9-9mxx-hq54':12A 'github.com':221C 'github.com/queueforge/clickmigrate/commit/6b1f2c0202630a82252b3331aa57e64327e112b6':220C 'hq54':16A 'immedi':191C 'impact':67C 'influenc':126C 'input':50B,147C,181C 'insecur':139C 'intend':89C 'invok':201C 'issu':118C 'later':175C 'let':33B 'locat':61B,109C 'm':7A,40B,84C,185C 'make':52B 'migrat':36B,43B,79C,90C,128C,162C,207C 'name':37B,80C,129C,163C,208C 'packag':27B 'pass':38B,130C,179C,213C 'patch':148C 'path':3A,69C 'pipelin':143C 'possibl':192C 'prevent':165C 'python':28B 'refer':217C 'revis':6A,31B,74C,133C,184C,203C 'run':63B 'sanit':160C 'specif':93C 'sql':57B,104C 'suppli':81C 'tool':54B,100C,216C 'travers':4A,70C,167C 'trust':196C 'untrust':146C,180C 'upgrad':170C,188C 'user':64B,113C,168C,197C 'valid':158C,210C 'version':155C,172C 'vgf9':14A 'via':39B,82C 'vulner':71C,150C 'workaround':176C 'writabl':110C 'write':55B,66B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T19:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-vgf9-9mxx-hq54","url":"https://github.com/advisories/GHSA-vgf9-9mxx-hq54","severity":"low","published_at":"2026-10-16T19:17:28+00:00","modified_at":"2026-10-16T19:17:30+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}