PT-2026-66469 · Gladinet · Centrestack

CVE-2026-54368 · Publicado 2026-07-30 · Atualizado 2026-07-30

NVD

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized interpolation of the Field parameter directly into SQL query strings to write arbitrary files to the server filesystem via PostgreSQL lo from bytea() and lo export() functions, enabling remote code execution.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-54368

Produtos afetados

Centrestack

Referências · 3

• https://centrestack.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-54368 · Nota de Segurança
• https://vulncheck.com/advisories/centrestack-sql-injection-via-x-glad-filter-header · Nota