---
id: "CVE-2026-68549"
kind: "vulnerability"
aliases: ["CVE-2026-68549", "GHSA-vgf9-9mxx-hq54"]
title: "ClickMigrate has Path Traversal in \"revision -m\" argument"
severity: "low"
cvss: 3.299999952316284
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ClickMigrate", "fixed": ["1.0.3"], "affected": "< 1.0.3", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ci-cd", "clickmigrate", "cwe-22", "package", "python"]
not_affected_if: ["default-config", "no-untrusted-migration-names"]
published_at: "2026-10-16T19:17:28+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T20:03:34+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-vgf9-9mxx-hq54", "first_seen_at": "2026-10-23T19:11:32+00:00"}]
---

# ClickMigrate has Path Traversal in "revision -m" argument

ClickMigrate's revision command let a crafted migration name passed via -m escape the migrations directory. An attacker who controls that input can make the tool write a .sql file to any location the running user can write to.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:ClickMigrate affected < 1.0.3 fixed 1.0.3

## How to check

Run pip show ClickMigrate and check whether the version is below 1.0.3.
Search CI/CD scripts for 'revision -m' to see whether any untrusted input reaches it.

## Fix

Upgrade ClickMigrate to 1.0.3 or later.
Until then, do not pass untrusted input to revision -m and validate migration names before calling the tool.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-vgf9-9mxx-hq54

## From the sources

### Impact
A path traversal vulnerability in the `revision` command allowed a crafted migration name supplied via the `-m` argument to escape the intended migrations directory.

Under specific conditions, an attacker could cause the tool to create a `.sql` file in an arbitrary location writable by the user executing the command.

This issue is only exploitable if an attacker can influence the migration name passed to the `revision` command, such as through an insecure automation or CI/CD pipeline that forwards untrusted input.

### Patches
The vulnerability has been fixed in version 1.0.3 by validating and sanitizing the migration name to prevent directory traversal.

Users should upgrade to version 1.0.3 or later.

### Workarounds
Do not pass untrusted input to the `revision -m` argument.

If upgrading is not immediately possible, ensure that only trusted users or automation can invoke the `revision` command and that migration names are validated before being passed to the tool.

### References
- Fix commit: https://github.com/QueueForge/ClickMigrate/commit/6b1f2c0202630a82252b3331aa57e64327e112b6

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_