Gladinet Centrestack

CentreStack <17.4 SQL Injection via GladDBFiles SearchEx() header
CVE-2026-54368 8.7 - High - July 30, 2026

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized interpolation of the Field parameter directly into SQL query strings to write arbitrary files to the server filesystem via PostgreSQL lo_from_bytea() and lo_export() functions, enabling remote code execution.

SQL Injection

CentreStack <17.2 Auth Bypass via API Encrypted CID
CVE-2026-54367 8.8 - High - July 30, 2026

CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the static shared encryption key to forge identifiers for any user GUID, including the system-wide cluster settings account, enabling enumeration of hosted tenant domains and administrator identities.

Missing Authentication for Critical Function

CentreStack 17.3 XXE in StorageConfig Allows Unauth File Exfiltration
CVE-2026-54366 8.7 - High - July 30, 2026

CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated StorageConfig endpoint causing the server to fetch and parse attacker-controlled XML containing external DTD references, resulting in out-of-band file exfiltration of sensitive files such as Web.config, which may contain database credentials and cryptographic key material.

XXE

CentreStack <17.3: Deserial. Enables Local OS Users via GSNamespace.dll
CVE-2026-54365 8.7 - High - July 30, 2026

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious StorageConfigure parameter to the jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn endpoints to trigger InternalImportAdUserByUPN(), causing GladinetCloudMonitor.exe to invoke the NetUserAdd Windows API with attacker-controlled credentials and create arbitrary directories on the server filesystem.

Missing Authentication for Critical Function

CentreStack <17.4 Session Variable Injection via SelectProvider.aspx
CVE-2026-54364 6.9 - Medium - July 30, 2026

CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit the lack of input sanitization in the custom session serialization format to inject a resellerid session variable, bypassing the IsValidRSession authentication check and gaining unauthorized access to management pages.

Output Sanitization

CentreStack <17.5 Hardcoded Key Allows Unauth Token Forgery & RCE
CVE-2026-54363 9.3 - Critical - July 30, 2026

CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt() and AccessTicket.Decrypt() across all installations. Attackers can use the hardcoded key to craft valid x-glad-auth headers and call privileged API endpoints such as acquiretenantbackuptoken to obtain a domain administrator IdentityTicket, enabling a complete unauthenticated remote code execution chain.

Use of Hard-coded Cryptographic Key

Gladinet CentreStack Hardcoded AES & LFI prior to 16.12.10420.56791
CVE-2025-14611 - December 12, 2025

Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.

Use of Hard-coded Credentials

Gladinet CentreStack/TrioFox LFI (<=16.7.10368.56560)
CVE-2025-11371 7.5 - High - October 09, 2025

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.  This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560

Files or Directories Accessible to External Parties

Gladinet CentreStack deserialization RCE via hardcoded machineKey v16.1
CVE-2025-30406 9 - Critical - April 03, 2025

Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.

Use of Hard-coded Cryptographic Key

Reflected XSS in Gladinet CentreStack v13.12.9934.54690 via sessionId param
CVE-2024-37783 - November 22, 2024

A reflected cross-site scripting (XSS) vulnerability in Gladinet CentreStack v13.12.9934.54690 allows attackers to inject malicious JavaScript into the web browser of a victim via the sessionId parameter at /portal/ForgotPassword.aspx.

LDAP Injection in Gladinet CentreStack v13.12.9934.54690 Login
CVE-2024-37782 - November 22, 2024

An LDAP injection vulnerability in the login page of Gladinet CentreStack v13.12.9934.54690 allows attackers to access sensitive data or execute arbitrary commands via a crafted payload injected into the username field.

Gladinet CentreStack <13.5.9808 Unrestricted File Upload
CVE-2023-26830 7.2 - High - March 31, 2023

An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before 13.5.9808 allows authenticated attackers to execute arbitrary code by uploading malicious files to the server.

Unrestricted File Upload

Auth bypass in Gladinet CentreStack <13.5.9808 Password Reset
CVE-2023-26829 9.8 - Critical - March 31, 2023

An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to set a new password for any valid user account, without needing the previous known password, resulting in a full authentication bypass.

AuthZ