CVE-2026-68549: ClickMigrate Path Traversal Vulnerability in Revision Command
Summary
CVE-2026-68549: ClickMigrate has Path Traversal in "revision -m" argument. Affects clickmigrate versions < 1.0.3. Fixed in 1.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ClickMigrate is an open-source migration tool designed for managing database schema changes. It allows developers to create, modify, and apply migrations easily. However, it has a vulnerability that can be exploited when untrusted input is passed to the 'revision -m' command, potentially leading to unauthorized file creation.
Vulnerability Detail
A path traversal vulnerability exists in the 'revision' command of ClickMigrate, where a crafted migration name supplied via the '-m' argument can escape the intended migrations directory. This vulnerability can allow an attacker to create a .sql file in an arbitrary location that is writable by the user executing the command. The issue arises when untrusted input influences the migration name, particularly in insecure automation or CI/CD pipelines.
How To Fix
Minimum fixed version
1.0.3
This is the first release that contains the fix.
pip install --upgrade "clickmigrate==1.0.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Avoid passing untrusted input to the 'revision -m' argument. Ensure that only trusted users or automation can invoke the 'revision' command, and validate migration names before passing them to the tool.
Conclusion
The path traversal vulnerability in ClickMigrate's 'revision' command poses a risk of unauthorized file creation. Users are advised to upgrade to version 1.0.3 or later to mitigate this issue. Implementing proper input validation and restricting command access can further enhance security.
See every vulnerability recorded for clickmigrate →
FAQ
The vulnerability is a path traversal issue that allows attackers to create files in unintended locations.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground.
If upgrading is not possible, ensure that only trusted users can invoke the 'revision' command and validate migration names.
The CVSS score for this vulnerability is 3.3, indicating a low severity level.
You can find more information about ClickMigrate on its official repository or documentation pages.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
