High severity · published Mar 31, 2023
CVE-2023-26830
An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before 13.5.9808 allows authenticated attackers to execute…
7.2
CVSS
1.1%
EPSS
No
On KEV
Description
An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before 13.5.9808 allows authenticated attackers to execute arbitrary code by uploading malicious files to the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Centrestack · Gladinet
before 13.5.9808 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-26830
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-26830
Exploit
https://www.whiteoaksecurity.com/blog/centrestack-disclosure/
More from Centrestack
9.8
CVE-2025-14611
Gladinet CentreStack and TrioFox Hard Coded AES Keys
9.8
CVE-2025-30406
Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability
7.5
CVE-2025-11371
Gladinet CentreStack and TrioFox Local File Inclusion Flaw
9.8
CVE-2023-26829
An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to set a new password for any valid user…
9.1
CVE-2026-54363
CentreStack < 17.5 Hardcoded Key Token Forgery RCE