A flaw in migration‑planner allows a remote authenticated attacker to upload a specially crafted RVTools .xlsx file. Improper input sanitization causes the spreadsheet’s embedded SQL to be executed when cluster names are processed. This second‑order SQL injection permits arbitrary file reading, exposing Kubernetes service account tokens and other credentials, which could lead to a full compromise of the SaaS environment.

Any deployed instance of migration‑planner may be vulnerable; specific affected versions are not listed in the advisory.

The CVSS score of 9.6 indicates a high‑severity risk. Although no EPSS score is available and the vulnerability is not yet listed in KEV, the remote authenticated nature and potential to read sensitive system files make exploitation likely in environments where users can upload RVTools files. An attacker with legitimate credentials could leverage the injection to read arbitrary files, retrieve critical secrets, and elevate privileges or take full control of the environment.