Is there a patch available for EUVD-2026-51100?

Yes, a patch is available for EUVD-2026-51100. Update the affected software to the latest version immediately.

CentreStack EUVD-2026-51100

Q: What is the CVSS score of EUVD-2026-51100?

EUVD-2026-51100 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-54364 MEDIUM

Improper Encoding or Escaping of Output (CWE-116)

2026-07-30 VulnCheck

GHSA-g6j6-rqg9-wq7x

Authentication Bypass Centrestack Gladinet

6.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network endpoint, no auth required, scope changes as authentication boundary is bypassed granting management access; no availability impact described.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 30, 2026 - 14:03 EUVD

Analysis Generated

Jul 30, 2026 - 13:32 vuln.today

DescriptionCVE.org

CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit the lack of input sanitization in the custom session serialization format to inject a resellerid session variable, bypassing the IsValidRSession authentication check and gaining unauthorized access to management pages.

AnalysisAI

Session variable injection in Gladinet CentreStack before version 17.4 allows unauthenticated remote attackers to bypass authentication and access management pages without credentials. By embedding newline and tab characters into the AccountName parameter posted to SelectProvider.aspx, attackers exploit the absence of input sanitization in the product's custom session serialization format to inject an arbitrary resellerid session variable, which satisfies the IsValidRSession authentication check and opens management interfaces. No public exploit has been identified at time of analysis, though VulnCheck discovered and reported this issue with sufficient detail to facilitate reproduction.

Technical ContextAI

CentreStack (CPE: cpe:2.3:a:gladinet:centrestack:*:*:*:*:*:*:*:*) is a cloud file server and collaboration platform by Gladinet. The vulnerability stems from a custom session serialization mechanism that uses delimiter characters - specifically newlines and tab characters - to separate session key-value pairs. The SelectProvider.aspx endpoint accepts a user-supplied AccountName parameter without stripping or escaping these structural delimiters before incorporating the value into session state. CWE-116 (Improper Encoding or Escaping of Output) identifies the root cause: the application fails to neutralize special characters that carry structural meaning within its own serialization format. This is a variant of CRLF injection applied to a session context rather than HTTP headers, enabling parameter smuggling within the session store. The targeted session variable, resellerid, is consumed by the IsValidRSession authentication guard, which treats its presence as proof of a valid authenticated reseller session.

RemediationAI

Upgrade CentreStack to version 17.4 or later, which is the first version confirmed to remediate this vulnerability per the CVE description. The VulnCheck advisory at https://www.vulncheck.com/advisories/centrestack-session-injection-via-selectprovider-aspx provides additional technical context to confirm fix applicability. No specific workaround instructions are published in available references. If immediate patching is not possible, restrict network access to the SelectProvider.aspx endpoint via WAF or reverse proxy rules that reject POST bodies containing URL-encoded or literal newline (\r, \n) and tab (\t) characters in the AccountName field - this specifically targets the injection vector without disabling the endpoint entirely, though it may affect legitimate provider selection functionality and should be tested in non-production first. Additionally, block or rate-limit unauthenticated POST requests to SelectProvider.aspx at the perimeter to reduce exposure surface while the upgrade is planned.