---
id: CVE-2026-68549
aliases:
  - GHSA-vgf9-9mxx-hq54
title: ClickMigrate has Path Traversal in "revision -m" argument
summary: ClickMigrate has Path Traversal in "revision -m" argument
severity: low
cvss: 3.3
cwe:
  - CWE-22
vendor: ClickMigrate
product: ClickMigrate
ecosystem: pip
affected:
  - ClickMigrate < 1.0.3
patched:
  - ClickMigrate 1.0.3
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:17:30Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-vgf9-9mxx-hq54'
references:
  - url: >-
      https://github.com/QueueForge/ClickMigrate/security/advisories/GHSA-vgf9-9mxx-hq54
  - url: >-
      https://github.com/QueueForge/ClickMigrate/commit/6b1f2c0202630a82252b3331aa57e64327e112b6
  - url: 'https://github.com/advisories/GHSA-vgf9-9mxx-hq54'
tags:
  - ghsa
  - pip
ingestedAt: '2026-10-16T19:46:24.283Z'
---

## Overview

### Impact
A path traversal vulnerability in the `revision` command allowed a crafted migration name supplied via the `-m` argument to escape the intended migrations directory.

Under specific conditions, an attacker could cause the tool to create a `.sql` file in an arbitrary location writable by the user executing the command.

This issue is only exploitable if an attacker can influence the migration name passed to the `revision` command, such as through an insecure automation or CI/CD pipeline that forwards untrusted input.

### Patches
The vulnerability has been fixed in version 1.0.3 by validating and sanitizing the migration name to prevent directory traversal.

Users should upgrade to version 1.0.3 or later.

### Workarounds
Do not pass untrusted input to the `revision -m` argument.

If upgrading is not immediately possible, ensure that only trusted users or automation can invoke the `revision` command and that migration names are validated before being passed to the tool.

### References
- Fix commit: https://github.com/QueueForge/ClickMigrate/commit/6b1f2c0202630a82252b3331aa57e64327e112b6

## Affected packages

- `ClickMigrate < 1.0.3`

## Remediation

Upgrade to a patched release:

- `ClickMigrate 1.0.3`