ClickMigrate has Path Traversal in "revision -m" argument (CVE-2026-68549)

The vulnerability (CVE-2026-68549) in ClickMigrate is a path traversal issue in the 'revision' command's '-m' argument. By supplying a crafted migration name, an attacker can escape the designated migrations directory and cause the creation of a .sql file in an arbitrary writable location. This requires the attacker to influence the migration name passed to the command, typically through insecure automation or CI/CD pipelines that accept untrusted input. The vulnerability is addressed in ClickMigrate version 1.0.3 by validating and sanitizing the migration name to prevent directory traversal.

An attacker able to control the migration name argument can cause ClickMigrate to write files outside the intended directory, potentially overwriting or creating files in arbitrary locations writable by the user running the command. This could lead to limited integrity impact but does not affect confidentiality or availability. The CVSS score is 3.3 (low severity), reflecting limited impact and the requirement for local privileges or control over migration names.

A fix is available in ClickMigrate version 1.0.3 and later. Users should upgrade to version 1.0.3 or above to remediate this vulnerability. If upgrading immediately is not feasible, ensure that only trusted users or automation can invoke the 'revision' command and validate migration names before passing them to the tool to prevent untrusted input from causing path traversal.