CVE-2026-54368 Gladinet CVE debrief

Who should care

Defenders responsible for CentreStack installations, security teams, and administrators should be aware of this vulnerability and take necessary actions to prevent exploitation. This includes verifying CentreStack versions, restricting access to the jsondir API endpoint, and sanitizing user input. Additionally, operators, platform administrators, and vulnerability management teams should review the vulnerability's impact on their environments and plan for

Why it matters

CVE-2026-54368 is a SQL injection vulnerability in CentreStack that allows authenticated attackers to execute arbitrary SQL statements, potentially leading to remote code execution. Defenders should verify CentreStack versions, restrict access to the jsondir API endpoint, and sanitize user input to prevent exploitation.

• Potential remote code execution
• Arbitrary file writing on the server filesystem
• SQL injection attacks via crafted request headers
• Verification of CentreStack version and patching

Technical summary

The SQL injection vulnerability in CentreStack before version 17.4 allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. This can be exploited to write arbitrary files to the server filesystem via PostgreSQL lo_from_bytea() and lo_export() functions, potentially enabling remote code execution. The vulnerability affects CentreStack installations prior to version 17.4, and defenders should focus on verifying CentreStack versions, restricting access to the jsondir API endpoint, and sanitizing user input to prevent SQL injection attacks.

Defensive priority

Defenders should prioritize verifying CentreStack versions, restricting access to the jsondir API endpoint, and sanitizing user input to prevent SQL injection attacks.

Recommended defensive actions

• Verify CentreStack version and apply patches if available
• Restrict access to the jsondir API endpoint
• Implement input validation and sanitization for user-supplied data
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the SQL injection vulnerability in CentreStack. However, the exact versions affected and patched are not specified, requiring further verification of CentreStack versions, patching status, and potential exposure to the jsondir API endpoint. Defenders should verify CentreStack installations, check for unsanitized user input, and review access controls for the jsondir API endpoint.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.