SQL Injection in migration-planner via crafted RVTools .xlsx upload (CVE-2026-53474)
critical-cve-against-dependency · active
A SQL injection flaw in migration-planner lets a remote authenticated attacker upload a specially crafted RVTools .xlsx file whose embedded SQL is executed when cluster names are processed. This enables arbitrary file reading that can expose Kubernetes service account tokens and credentials, potentially leading to full compromise of the SaaS environment.