HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-54368 — CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.Se...

·Source: NIST NVD

Updated:

Executive Summary

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized interpolation of the Field parameter directly into SQL query strings to write arbitrary files to th

Analysis

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized interpolation of the Field parameter directly into SQL query strings to write arbitrary files to the server filesystem via PostgreSQL lo_from_bytea() and lo_export() functions, enabling remote code execution. CVSS Score: 8.8. Published: 2026-07-30T13:16:51.910.

Indicators of Compromise (1)

CVE (1)
CVE-2026-54368
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 30, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

FCA streamlines transaction reporting obligations

Transaction reporting requirements become smarter, simpler and more proportionate under new rules from the FCA.

Finextra
MEDIUMVulnerabilityNEW

Santander embeds eSim package within mobile app

Banco Santader customers in Spain can now purchase and activate mobile data for roaming abroad, directly in the bank's mobile app.

Finextra
MEDIUMVulnerabilityNEW

Mastercard strengthens Asia Pacific leadership team

Mastercard today announced that Joyce Bo has joined the company as Executive Vice President, Core Payments, Asia Pacific.

Finextra