EUVD-2026-51102
GHSA-m68w-g32j-mw5x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network XXE with low complexity and no interaction (AV:N/AC:L/PR:N/UI:N); high confidentiality from arbitrary file read, no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated StorageConfig endpoint causing the server to fetch and parse attacker-controlled XML containing external DTD references, resulting in out-of-band file exfiltration of sensitive files such as Web.config, which may contain database credentials and cryptographic key material.
AnalysisAI
Out-of-band file exfiltration in Gladinet CentreStack before 17.4 lets unauthenticated remote attackers read arbitrary server files by abusing an XML External Entity (XXE) flaw in the SharePoint StorageConfig handler. By pointing the storage configuration at a malicious URL, an attacker forces the server to parse attacker-controlled XML with external DTD references and leak sensitive files such as Web.config, exposing database credentials and cryptographic key material. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the CentreStack SharePoint storage configuration handler - specifically the unauthenticated StorageConfig endpoint - is network-reachable by the attacker, and that the attacker can host an external DTD/callback server to receive out-of-band data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, which is the most dangerous exploitation profile; the 8.7 score reflects high confidentiality impact (VC:H) with no integrity or availability impact (VI:N/VA:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a crafted request to the internet-facing CentreStack StorageConfig endpoint, supplying a malicious URL that returns XML referencing an external DTD hosted on the attacker's server. The CentreStack server fetches and parses the XML, resolves the external entity pointing at C:\...\Web.config, and transmits the file contents out-of-band to the attacker, who harvests database credentials and the machineKey. … |
| Remediation | Upgrade to Gladinet CentreStack 17.4 or later, which is the vendor-fixed version resolving this XXE flaw; treat this as the primary remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Gladinet CentreStack deployments and their current versions, then restrict network access to the SharePoint StorageConfig handler to trusted internal sources only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Centrestack
View allGladinet CentreStack contains a deserialization vulnerability caused by a hardcoded machineKey in the portal, allowing u
An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows r
An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before
Unauthenticated remote code execution in Gladinet CentreStack before 17.5 stems from a hardcoded cryptographic key (a st
Authentication bypass in Gladinet CentreStack before 17.2 lets unauthenticated remote attackers read, write, and delete
Unauthenticated OS user-account creation in Gladinet CentreStack before 17.3 lets remote attackers abuse an insecure des
SQL injection leading to remote code execution in Gladinet CentreStack before 17.4 lets authenticated users inject arbit
Session variable injection in Gladinet CentreStack before version 17.4 allows unauthenticated remote attackers to bypass
Share
External POC / Exploit Code
Leaving vuln.today