Skip to content
OpenAdvisories
High WID-SEC-2026-2607 6 CVEs

Gladinet CentreStack: Mehrere Schwachstellen

Published Jul 30, 2026 · Updated Jul 30, 2026 · de-DE

Vendor: Gladinet Product: CentreStack Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Gladinet CentreStack ausnutzen, um beliebigen Programmcode auszuführen,SQL-Injection durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

Product

Gladinet CentreStack ist eine Self-Hosting-Cloud-Lösung, die es Unternehmen ermöglicht, ihre eigene Dateisynchronisations- und Freigabeinfrastruktur aufzubauen.

Vulnerabilities 6

  • Critical 9.1
    CVE-2026-54363

    CentreStack < 17.5 Hardcoded Key Token Forgery RCE

    CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt() and AccessTicket.Decrypt()…

    Gladinet CentreStack
  • High 8.8
    CVE-2026-54368

    CentreStack < 17.4 SQL Injection via x-glad-filter Header

    CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API en…

    Gladinet CentreStack
  • High 8.6
    CVE-2026-54367

    CentreStack < 17.2 Unauthenticated API Authorization Bypass

    CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid…

    Gladinet CentreStack
  • High 7.5
    CVE-2026-54365

    CentreStack < 17.3 Unauthenticated User Creation via Deserialization in GSNamespace.dll

    CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. At…

    Gladinet CentreStack
  • High 7.5
    CVE-2026-54366

    CentreStack < 17.4 XXE via SharePoint Storage Configuration

    CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafte…

    Gladinet CentreStack
  • Medium 6.5
    CVE-2026-54364

    CentreStack < 17.4 Session Injection via SelectProvider.aspx

    CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.a…

    Gladinet CentreStack

Revision history

  1. #1

    Initiale Fassung

References