# CVE-2026-54368: Gladinet CentreStack SQL injection in jsondir API x-glad-filter header

Source: https://junglewise.ai/threats/cve-2026-54368-gladinet-centrestack-sql-injection-in-jsondir-api-x-glad-filter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-54368 · Severity: high · CVSS 8.8 · Published 2026-07-30

CentreStack, a file-sharing and remote access platform used by managed service providers, contains a security vulnerability that allows authorized users to gain full control over the server. By sending specially crafted requests to the system's API, an attacker can bypass security controls to run unauthorized database commands. This can lead to the theft of sensitive client data, the ability to plant malicious files on the server, and complete system takeover, potentially impacting all organizations managed through the platform.

Technologies: [Gladinet CentreStack](https://junglewise.ai/threats/technologies/centrestack). Vendors: [Gladinet](https://junglewise.ai/threats/vendors/gladinet).

## Quick answers

**Is CVE-2026-54368 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54368 being exploited in the wild.

**How severe is CVE-2026-54368?** High severity, with a CVSS score of 8.8, published 30 July 2026.

**Which products and versions are affected?** Gladinet CentreStack before 17.4.

**Is there a fix for CVE-2026-54368?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-54368 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-54368?** Check whether you run Gladinet CentreStack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in CentreStack versions prior to 17.4 within the GladDBFiles.SearchEx() and SearchExUnder() functions. The flaw is rooted in the unsanitized interpolation of the 'Field' parameter from the 'x-glad-filter' request header into SQL query strings via the jsondir API endpoint. An authenticated attacker can exploit this to execute arbitrary SQL commands. In environments using PostgreSQL, this can be further escalated to remote code execution (RCE) by utilizing the lo_from_bytea() and lo_export() functions to write malicious files directly to the server's filesystem. Users should upgrade to CentreStack version 17.4 or later to remediate this vulnerability.

## Affected products

- Gladinet CentreStack before 17.4

## Timeline

- 2026-07-30: advisory: NVD and VulnCheck published the advisory.

## References

- [https://www.centrestack.com/](https://www.centrestack.com/)
- [https://www.vulncheck.com/advisories/centrestack-sql-injection-via-x-glad-filter-header](https://www.vulncheck.com/advisories/centrestack-sql-injection-via-x-glad-filter-header)

## Related threats

- [Gladinet CentreStack auth bypass in API endpoints](https://junglewise.ai/threats/cve-2026-54367-gladinet-centrestack-auth-bypass-in-api-endpoints)
- [Gladinet CentreStack XXE in SharePoint storage configuration handler](https://junglewise.ai/threats/cve-2026-54366-gladinet-centrestack-xxe-in-sharepoint-storage-configuration)
- [Gladinet CentreStack unauthenticated deserialization in GSNamespace.dll](https://junglewise.ai/threats/cve-2026-54365-gladinet-centrestack-unauthenticated-deserialization-in)
- [Gladinet CentreStack session variable injection in SelectProvider.aspx](https://junglewise.ai/threats/cve-2026-54364-gladinet-centrestack-session-variable-injection-in-selectprovider)
- [Gladinet CentreStack hardcoded cryptographic key in AccessTicket](https://junglewise.ai/threats/cve-2026-54363-gladinet-centrestack-hardcoded-cryptographic-key-in-accessticket)