High severity · published Jul 30, 2026
CVE-2026-54368
CentreStack < 17.4 SQL Injection via x-glad-filter Header
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized interpolation of the Field parameter directly into SQL query strings to write arbitrary files to the server filesystem via PostgreSQL lo_from_bytea() and lo_export() functions, enabling remote code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
CentreStack · Gladinet
before 17.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54368
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54368
www.centrestack.com
https://www.centrestack.com/
www.vulncheck.com
https://www.vulncheck.com/advisories/centrestack-sql-injection-via-x-glad-filter-header
More from CentreStack
9.8
CVE-2025-14611
Gladinet CentreStack and TrioFox Hard Coded AES Keys
9.8
CVE-2025-30406
Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability
7.5
CVE-2025-11371
Gladinet CentreStack and TrioFox Local File Inclusion Flaw
9.8
CVE-2023-26829
An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to set a new password for any valid user…
9.1
CVE-2026-54363
CentreStack < 17.5 Hardcoded Key Token Forgery RCE