CVE-2026-54368: CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements

highCVSS 8.8CVE-2026-54368

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized interpolation of the Field parameter directly into SQL query strings to write arbitrary files to the server filesystem via PostgreSQL lo_from_bytea() and lo_export() functions, enabling remote code execution.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 8.8
Published: 2026-07-30
Last updated: 2026-07-30
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-54368

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-543680.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-54368	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[NEU] [hoch] Gladinet CentreStack: Mehrere Schwachstellencert-bund

Recent advisories for CentreStack

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

high[NEU] [hoch] Gladinet CentreStack: Mehrere Schwachstellencert-bund · 2026-07-31
highCVE-2026-54367: CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenti…nvd · 2026-07-30
highCVE-2026-54366: CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that all…nvd · 2026-07-30
highCVE-2026-54365: CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespa…nvd · 2026-07-30
mediumCVE-2026-54364: CentreStack before 17.4 contains a session variable injection vulnerability that allows unauth…nvd · 2026-07-30
criticalCVE-2026-54363: CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unaut…nvd · 2026-07-30