CVE-2026-68549: Path Traversal
Impact A path traversal vulnerability in the revision command allowed a crafted migration name supplied via the -m argument to escape the intended migrations directory.
Under specific conditions, an attacker could cause the tool to create a .sql file in an arbitrary location writable by the user executing the command.
This issue is only exploitable if an attacker can influence the migration name passed to the revision command, such as through an insecure automation or CI/CD pipeline that forwards untrusted input.
Patches The vulnerability has been fixed in version 1.0.3 by validating and sanitizing the migration name to prevent directory traversal.
Users should upgrade to version 1.0.3 or later.
Workarounds Do not pass untrusted input to the revision -m argument.
If upgrading is not immediately possible, ensure that only trusted users or automation can invoke the revision command and that migration names are validated before being passed to the tool.
References - Fix commit: https://github.com/QueueForge/ClickMigrate/commit/6b1f2c0202630a82252b3331aa57e64327e112b6
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/ClickMigrateto a version that resolves this vulnerability.Fixed in 1.0.3 - Upgrade
Upgrade
QueueForge/ClickMigrateto a version that resolves this vulnerability.Fixed in 1.0.3 - Compensating control
Until upgrading, do not pass untrusted input to the revision -m argument; restrict invocation of the revision command to trusted users or automation, and validate migration names before passing them to the tool.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Installations are exposed when an untrusted party can influence the migration name supplied to the revision command, particularly through automation or CI/CD pipelines that forward untrusted input. The attacker also needs the ability to cause the command to run as a user with write access to the target location.
Are default command invocations affected?
The issue requires a crafted migration name passed through the -m argument to the revision command. It is not exploitable when that argument is restricted to trusted, validated values.
What can be done if an upgrade is not immediately possible?
Do not pass untrusted input to revision -m. Restrict invocation of the revision command to trusted users or automation, and validate migration names before passing them to the tool.
How can the issue be remediated?
Upgrade ClickMigrate to version 1.0.3 or later. This version validates and sanitizes migration names to prevent directory traversal.