CVE-2026-54368: 
Gladinet CentreStack vulnerability analysis and mitigation

CVE-2026-54368 is a SQL injection vulnerability in Gladinet CentreStack affecting all versions before 17.4. The flaw resides in the GladDBFiles.SearchEx() and SearchExUnder() methods, allowing authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint, ultimately enabling remote code execution. It was published on July 30, 2026, with a patch available in version 17.4. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically unsanitized interpolation of the Field parameter from the x-glad-filter request header directly into SQL query strings within GladDBFiles.SearchEx() and SearchExUnder(). An authenticated attacker can craft a malicious x-glad-filter header value targeting the jsondir API endpoint to inject arbitrary SQL. The injected SQL can leverage PostgreSQL's lo_from_bytea() and lo_export() functions to write arbitrary files to the server filesystem, which can then be used to achieve remote code execution. No public proof-of-concept exploit code has been identified at this time (GitHub Advisory, VulnCheck Advisory).

Successful exploitation grants an authenticated attacker full control over the CentreStack server, with high impact to confidentiality, integrity, and availability. By writing arbitrary files to the server filesystem via PostgreSQL large object functions, an attacker can deploy web shells or malicious executables to achieve remote code execution, potentially enabling lateral movement within the network, exfiltration of sensitive data stored on the server, and complete service disruption (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.39% (32nd percentile), indicating a relatively low near-term exploitation probability. Exploitation requires valid authentication credentials (low privilege), but no user interaction or special configuration, making it accessible to any authenticated user on the platform (GitHub Advisory).

1. Reconnaissance: Identify internet-facing CentreStack instances running versions prior to 17.4 using network scanning tools or search engines such as Shodan or Censys.
2. Obtain credentials: Acquire valid low-privilege user credentials for the target CentreStack instance (e.g., via phishing, credential stuffing, or a free/trial account).
3. Authenticate: Log in to the CentreStack instance to obtain a valid session token or authentication cookie.
4. Craft malicious request: Send an HTTP request to the jsondir API endpoint, injecting a malicious SQL payload into the x-glad-filter request header, targeting the unsanitized Field parameter in GladDBFiles.SearchEx() or SearchExUnder().
5. Execute arbitrary SQL: The injected SQL payload executes arbitrary statements against the backend PostgreSQL database.
6. Write file to filesystem: Use PostgreSQL's lo_from_bytea() function to store a malicious file (e.g., a web shell) as a large object, then use lo_export() to write it to a web-accessible directory on the server filesystem.
7. Achieve remote code execution: Access the written web shell via HTTP to execute arbitrary operating system commands on the CentreStack server (GitHub Advisory, VulnCheck Advisory).

• Network: Unusual HTTP requests to the jsondir API endpoint containing SQL syntax (e.g., lo_from_bytea, lo_export, SELECT, INSERT) within the x-glad-filter header; unexpected outbound connections from the CentreStack server to external IPs.
• Logs: Web server or application logs showing repeated or anomalous requests to the jsondir endpoint with abnormal x-glad-filter header values; PostgreSQL logs recording unexpected large object operations (lo_from_bytea, lo_export) or file write activity.
• File System: Newly created or modified files in web-accessible directories of the CentreStack installation, particularly script files (e.g., .aspx, .php, .jsp) not associated with normal application updates.
• Process: Unexpected child processes spawned by the CentreStack application or PostgreSQL service (e.g., cmd.exe, powershell.exe, bash, curl, wget) (GitHub Advisory, Feedly).

Upgrade CentreStack to version 17.4 or later, which contains the fix for this vulnerability (GitHub Advisory). If immediate patching is not feasible, restrict network access to the jsondir API endpoint and enforce strict authentication controls to limit access to trusted users only. Additionally, monitor API logs for suspicious x-glad-filter request headers containing SQL syntax as a detection measure until patching can be completed (Feedly).

The vulnerability was assigned and disclosed by VulnCheck, which published a dedicated advisory (VulnCheck Advisory). It was referenced in a CISA weekly vulnerability bulletin (SB26-215) shortly after disclosure, indicating it received attention from the broader security community. No notable researcher commentary or significant social media discussion has been identified beyond standard aggregator coverage.