PT-2026-66469 · Gladinet · Centrestack

CVE-2026-54368 · Published 2026-07-30 · Updated 2026-07-30

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized interpolation of the Field parameter directly into SQL query strings to write arbitrary files to the server filesystem via PostgreSQL lo from bytea() and lo export() functions, enabling remote code execution.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-54368

Affected Products

Centrestack

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-54368 · Security Note
• https://centrestack.com · Note
• https://vulncheck.com/advisories/centrestack-sql-injection-via-x-glad-filter-header · Note