CVE-2026-68549: 
Python vulnerability analysis and mitigation

CVE-2026-68549 is a path traversal vulnerability in ClickMigrate, a Python-based database migration tool distributed via PyPI. The flaw exists in the revision command's handling of the -m (migration name) argument, allowing a crafted input to escape the intended migrations directory and write a .sql file to an arbitrary location. It affects all versions of ClickMigrate prior to 1.0.3 and was originally published on July 4, 2026, with the advisory added to the GitHub Advisory Database on October 16, 2026. The vulnerability carries a CVSS v3.1 base score of 3.3 (Low) (GitHub Advisory, ClickMigrate Advisory).

The root cause is improper input sanitization in the create_revision() function within src/clickmigrate/manager.py, classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Prior to the fix, the migration name was only lowercased and had spaces/hyphens replaced with underscores — path traversal sequences such as ../ were not stripped, allowing the constructed filename to resolve outside the configured migrations directory. The fix (commit 6b1f2c0) applies a regex re.sub(r"[^a-zA-Z0-9_]", "", ...) to strip all non-alphanumeric characters before building the file path. Exploitation requires local access and the ability to control the value passed to revision -m, such as through an insecure CI/CD pipeline that forwards untrusted user input (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to cause ClickMigrate to create a .sql file at an arbitrary path writable by the user running the command, resulting in a low-severity integrity impact with no confidentiality or availability consequences. The scope is limited to the local system and the permissions of the executing user. As noted by the maintainer, an attacker capable of exploiting this would already need write access to the migration directory, making the practical additional risk minimal (GitHub Advisory, Fix Commit).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-68549. The Feedly threat intelligence data shows no recorded exploitation events and no PoC entries. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained to scenarios where an attacker can supply untrusted input to the revision -m argument, such as through a misconfigured CI/CD pipeline, significantly limiting the attack surface (GitHub Advisory).

1. Identify a vulnerable target: Locate an environment running ClickMigrate < 1.0.3 where the revision command is invoked with externally controlled input (e.g., a CI/CD pipeline that passes user-supplied strings to clickmigrate revision -m <input>).
2. Craft a malicious migration name: Construct a migration name containing path traversal sequences, such as ../../etc/cron.d/malicious, designed to resolve outside the configured migrations directory.
3. Inject the payload: Supply the crafted name as the -m argument, e.g., clickmigrate revision -m "../../tmp/malicious".
4. Trigger file creation: ClickMigrate's create_revision() function constructs the filename without sanitizing traversal sequences and calls os.path.join(self.config.migration_directory, filename), resulting in a .sql file (e.g., 001_../../tmp/malicious.sql) being written to the attacker-controlled path, provided the executing user has write permission there (GitHub Advisory, Fix Commit).

• File System: Unexpected .sql files created outside the configured migrations directory, particularly in sensitive locations such as /tmp/, home directories, or system configuration paths.
• Logs: CI/CD pipeline logs showing clickmigrate revision -m invocations with arguments containing ../, ..\, or URL-encoded traversal sequences (%2e%2e%2f).
• Process: Execution of clickmigrate with unusual -m argument values containing special characters or path separators, especially when triggered by automated pipelines rather than interactive users.

Users should upgrade ClickMigrate to version 1.0.3 or later, which validates and sanitizes the migration name by stripping all non-alphanumeric characters before constructing the file path (GitHub Advisory). As an immediate workaround if upgrading is not possible, restrict invocation of the revision command to trusted users only and validate migration name inputs before passing them to the tool. CI/CD pipelines should never forward raw, untrusted user input directly to the revision -m argument (ClickMigrate Advisory).