ClickMigrate Path Traversal in "revision -m" Argument
Impact
A path traversal vulnerability in the revision command allowed a crafted migration name supplied via the -m argument to escape the intended migrations directory.
Under specific conditions, an attacker could cause the tool to create a .sql file in an arbitrary location writable by the user executing the command.
This issue is only exploitable if an attacker can influence the migration name passed to the revision command, such as through an insecure automation or CI/CD pipeline that forwards untrusted input.
Patches
The vulnerability has been fixed in version 1.0.3 by validating and sanitizing the migration name to prevent directory traversal.
Users should upgrade to version 1.0.3 or later.
Workarounds
Do not pass untrusted input to the revision -m argument.
If upgrading is not immediately possible, ensure that only trusted users or automation can invoke the revision command and that migration names are validated before being passed to the tool.
References
- Fix commit: https://github.com/QueueForge/ClickMigrate/commit/6b1f2c0202630a82252b3331aa57e64327e112b6
What to do
Upgrade to version 1.0.3 or later. If upgrading immediately is not possible, avoid passing untrusted input to the revision -m argument and ensure only trusted users or automation can execute the revision command with pre-validated migration names.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | clickmigrate | < 1.0.3 | 1.0.3 |
References
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N- Weakness (CWE)
CWE-22- Platform
- Python (PyPI)
- Package
clickmigrate- Disclosed
- 16.10.2026
- Updated
- 19.10.2026 08:00
Sources and licenses · Edited or translated by DockRay; source rights and applicable licenses are retained.
OSV / GitHub Advisory Database - GHSA-vgf9-9mxx-hq54 - CC BY 4.0
Vulnerability history: clickmigrate
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.