Vulnerability · Published Jul 30, 2026 · Assigned by VulnCheck

CVE-2026-54366CentreStack < 17.4 XXE via SharePoint Storage Configuration

High 7.5

In plain English

A high-severity XML external entity in CentreStack from Gladinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 57.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated StorageConfig endpoint causing the server to fetch and parse attacker-controlled XML containing external DTD references, resulting in out-of-band file exfiltration of sensitive files such as Web.config, which may contain database credentials and cryptographic key material.

Affected products (as reported)

Vendor	Product	Versions
Gladinet	CentreStack	0 – before 17.4

Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Product Homepage product
https://www.vulncheck.com/advisories/centrestack-xxe-via-sharepoint-storage-configuration third-party-advisory