CVE-2026-54366: 
Gladinet CentreStack vulnerability analysis and mitigation

CVE-2026-54366 is an XML External Entity (XXE) injection vulnerability in Gladinet CentreStack affecting all versions before 17.4. It allows unauthenticated remote attackers to exfiltrate arbitrary files from the server by supplying a malicious URL to the SharePoint storage configuration handler. The vulnerability was published on July 30, 2026, with a patch available in version 17.4. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (Github Advisory, VulnCheck).

The vulnerability is classified as CWE-611 (Improper Restriction of XML External Entity Reference). The unauthenticated StorageConfig endpoint, which handles SharePoint storage configuration, accepts a user-supplied URL and fetches the resource without adequate validation. An attacker can point this URL to an attacker-controlled server hosting malicious XML containing external DTD references, causing the CentreStack server to parse the XML and exfiltrate local file contents out-of-band — a classic Server-Side Request Forgery (SSRF)-assisted XXE attack. No authentication or user interaction is required, and the attack complexity is low (Github Advisory, VulnCheck).

Successful exploitation allows unauthenticated attackers to read arbitrary files from the CentreStack server's filesystem. The most sensitive target is Web.config, which may contain database credentials and cryptographic key material. Exposure of these secrets could enable further attacks such as database compromise, authentication token forgery, or full application takeover, significantly amplifying the initial confidentiality breach (Github Advisory, VulnCheck).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.287% (21st percentile), indicating a currently low probability of exploitation within 30 days. However, the attack is fully automatable — requiring no authentication, no user interaction, and low complexity — which increases the risk of future exploitation if left unpatched.

1. Reconnaissance: Identify internet-facing CentreStack instances running versions prior to 17.4 using tools like Shodan or Censys, searching for CentreStack-specific HTTP response headers or login pages.
2. Set up attacker-controlled server: Host a malicious XML file on an attacker-controlled server (e.g., http://attacker.com/evil.dtd) containing an external entity definition that references a sensitive local file, such as:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE foo [
     <!ENTITY xxe SYSTEM "file:///C:/inetpub/wwwroot/Web.config">
   ]>
   <foo>&xxe;</foo>

3. Craft malicious request: Send an HTTP request to the unauthenticated StorageConfig endpoint, supplying the attacker-controlled URL as the SharePoint storage configuration URL parameter.
4. Trigger server-side fetch and parse: The CentreStack server fetches the attacker-controlled URL, parses the malicious XML, and resolves the external entity by reading the specified local file.
5. Receive exfiltrated data: The resolved file contents are transmitted out-of-band to the attacker's server (e.g., via DNS or HTTP callback), exposing sensitive data such as database credentials and cryptographic keys from Web.config (Github Advisory, VulnCheck).

• Network: Outbound HTTP or DNS requests from the CentreStack server to unexpected external hosts, particularly shortly after requests to the StorageConfig endpoint; unusual outbound connections carrying file content in request bodies or DNS query strings.
• Logs: Web server access logs showing POST or GET requests to the StorageConfig endpoint with external URLs as parameters, especially from unfamiliar or automated source IPs; repeated requests from a single IP in a short timeframe.
• File System: No direct file system artifacts are expected from a read-only XXE exfiltration attack, but review of Web.config access timestamps may reveal unexpected reads.
• Process: XML parser processes initiating outbound network connections, which is atypical for normal CentreStack operation.

Upgrade CentreStack to version 17.4 or later, which contains the fix for this vulnerability (Github Advisory, VulnCheck). As a workaround prior to patching, restrict network access to the StorageConfig endpoint so it is only reachable by trusted administrators, using firewall rules or reverse proxy ACLs. Additionally, implement XML parser hardening by disabling external entity resolution and DTD processing at the application or server level where possible.