Vulnerability · Published Jul 30, 2026 · Assigned by VulnCheck

CVE-2026-54368CentreStack < 17.4 SQL Injection via x-glad-filter Header

High 8.8

In plain English

A high-severity SQL injection in CentreStack from Gladinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.7%top 46.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized interpolation of the Field parameter directly into SQL query strings to write arbitrary files to the server filesystem via PostgreSQL lo_from_bytea() and lo_export() functions, enabling remote code execution.

Affected products (as reported)

Vendor	Product	Versions
Gladinet	CentreStack	0 – before 17.4

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Product Homepage product
https://www.vulncheck.com/advisories/centrestack-sql-injection-via-x-glad-filter-header third-party-advisory