ClickMigrate CVE-2026-68549

Exploitation requires that an attacker can control or influence the migration name passed to the revision -m argument - for example an insecure CI/CD pipeline or automation that forwards untrusted input (branch names, PR titles, webhook fields) directly into the command. It is NOT remotely exploitable against a default install: the attacker needs an execution path into the local revision command invocation (PR:L, AV:L). Limiting factors: impact is capped to creating a .sql file in a location writable by the user running the tool (no overwrite of arbitrary content types, no code execution, no read/exfiltration), and installations that only ever pass trusted, hard-coded migration names are not exploitable at all.

This is a low-severity, low-priority issue despite being a genuine path traversal (CWE-22). The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 3.3) is internally consistent and credible: it describes a locally-exploitable flaw requiring low privileges (PR:L) - the attacker must already be able to invoke the revision command or influence its -m argument - with only a limited integrity impact (I:L, arbitrary .sql file creation) and no confidentiality or availability impact. No EPSS score was provided, there is no CISA KEV listing, and no public exploit code was identified; the only exploitation primitive is the fix commit diff, which confirms the root cause (unsanitized message used to build a filename) but is not a weaponized PoC. The description and CVSS agree with each other (both point to a local/input-dependent, non-remote vector), so there are no conflicting signals here. The practical risk is almost entirely gated by the deployment precondition the vendor states explicitly: exploitation requires untrusted input to reach revision -m, e.g. via an insecure CI/CD pipeline. Absent that specific misconfiguration, the flaw is not reachable by an external attacker. Net: a real bug worth patching opportunistically, not an urgent priority.

A CI/CD pipeline or automation wrapper invokes ClickMigrate's revision -m <name> using a migration name derived from untrusted input (e.g. a branch name, PR title, or webhook field). An attacker supplies a crafted name containing traversal sequences (e.g. ../../), causing the tool to write a .sql file outside the intended migrations directory to any path writable by the executing user. No public exploit code was identified at time of analysis; the fix commit confirms the unsanitized-filename root cause.