Which versions of CentreStack are affected by EUVD-2026-51104?

Gladinet CentreStack before version 17.4 contains a SQL injection vulnerability in the jsondir API endpoint that authenticated users can exploit to achieve remote code execution on the server.. A patch is available.

How to fix or mitigate EUVD-2026-51104?

Within 24 hours, identify all Gladinet CentreStack deployments and document current versions, then immediately restrict network access to the x-glad-filter endpoint and review authenticated user access logs for suspicious SQL patterns. Within 7 days, implement Web Application Firewall (WAF) rules to block requests with SQL injection patterns in the x-glad-filter HTTP header, and establish daily monitoring of PostgreSQL error logs for lo_from_bytea() and lo_export() function calls. Within 30 days, maintain current monitoring and prepare infrastructure for rapid patching upon vendor release-once Gladinet releases CentreStack version 17.4 or later, apply the security update within 48 hours across all affected systems.

CentreStack EUVD-2026-51104

Q: What is the CVSS score of EUVD-2026-51104?

EUVD-2026-51104 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-54368 HIGH

SQL Injection (CWE-89)

2026-07-30 VulnCheck

GHSA-4cmj-5m56-fg8c

RCE SQLi PostgreSQL Centrestack Gladinet

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable API with low complexity needs only a low-privilege authenticated account (PR:L), and the SQLi-to-file-write yields full RCE, so C/I/A all High; scope unchanged as impact stays on the host.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 30, 2026 - 14:03 EUVD

Analysis Generated

Jul 30, 2026 - 13:21 vuln.today

CVE Published

Jul 30, 2026 - 12:26 cve.org

HIGH 8.7

DescriptionCVE.org

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized interpolation of the Field parameter directly into SQL query strings to write arbitrary files to the server filesystem via PostgreSQL lo_from_bytea() and lo_export() functions, enabling remote code execution.

AnalysisAI

SQL injection leading to remote code execution in Gladinet CentreStack before 17.4 lets authenticated users inject arbitrary SQL through the x-glad-filter HTTP header handled by the jsondir API endpoint. Because the injected query runs on the PostgreSQL backend, attackers chain lo_from_bytea() and lo_export() to write arbitrary files onto the server filesystem, converting a database flaw into full code execution. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

CentreStack is a Gladinet enterprise file-sharing and sync-and-share platform, backed here by a PostgreSQL database. The root cause is CWE-89 (SQL Injection): the GladDBFiles.SearchEx() and SearchExUnder() routines interpolate the attacker-controlled Field parameter - delivered via the x-glad-filter request header on the jsondir endpoint - directly into SQL query strings without parameterization or sanitization. Beyond data theft, the flaw is weaponized through PostgreSQL large-object functions lo_from_bytea() (loads bytes into a large object) and lo_export() (writes that object to a filesystem path), which together allow arbitrary file writes and therefore server-side code execution. The single affected package is identified by CPE cpe:2.3:a:gladinet:centrestack:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: upgrade to CentreStack 17.4, which resolves the SQL injection in GladDBFiles.SearchEx() and SearchExUnder(); this is the primary and authoritative fix, referenced via the VulnCheck advisory (https://www.vulncheck.com/advisories/centrestack-sql-injection-via-x-glad-filter-header) and the Gladinet site (https://www.centrestack.com/). If immediate patching is not possible, apply compensating controls: filter or strip the x-glad-filter request header at a reverse proxy or WAF and block anomalous SQL/large-object syntax (lo_from_bytea, lo_export) in that header, accepting that legitimate filter/search functionality relying on that header may break; restrict network access to the jsondir API endpoint to trusted management networks or VPN, which limits usability for remote/mobile clients; and, because exploitation escalates through PostgreSQL large-object export, revoke unneeded filesystem-write and large-object privileges from the database role CentreStack uses and enforce least privilege on the PostgreSQL data/export directories, at the cost of disabling any features that legitimately rely on those functions. Because exploitation requires authentication, also rotate and tighten low-privilege account access and monitor authenticated sessions until patched.