CVE-2026-53474

Critical · CVSS 9.6

migration-planner (kubev2v/migration-planner) — SQL Injection via unsanitized spreadsheet cell input (CWE-89)

CVSS: 9.6; nvd
EPSS: 0.31%; 23th pct
KEV: No
Class: other; CWE-89

Description

A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL Injection allows for arbitrary file reading on the system, potentially exposing sensitive information such as Kubernetes service account tokens and other credentials, which could lead to a full compromise of the SaaS environment.

Search profile — drives PoC discovery

Symbols cluster namesRVTools.xlsxmigration-plannerSQL injectionKubernetes service account tokensarbitrary file readingspreadsheet cellinput sanitization

Keywords CVE-2026-53474migration-planner SQL injectionkubev2v migration-plannerRVTools xlsx SQL injectionmigration-planner xlsx uploadmigration-planner cluster name SQLimigration-planner arbitrary file readmigration-planner kubernetes token exposurekubev2v CVE-2026-53474 PoCmigration-planner pull 1231

Versions: All versions prior to the fix introduced in pull request #1231

References

Status: enriched · ingested 2026-06-16T18:00:52.000Z · profiled 2026-06-16T18:20:23.035Z