XML External Entity Injection in CentreStack by CentreStack
CVE-2026-54366

8.7HIGH

Key Information:

Vendor

Gladinet

Status
Centrestack
Vendor
CVE Published:
30 July 2026

What is CVE-2026-54366?

CentreStack versions prior to 17.4 are susceptible to an XML external entity (XXE) injection vulnerability, which enables unauthenticated attackers to exfiltrate sensitive files by delivering a specially crafted URL to the SharePoint storage configuration handler. By exploiting the unauthenticated StorageConfig endpoint, attackers can compel the server to process malicious XML that includes external DTD references. This exploitation may lead to out-of-band file retrieval, potentially exposing critical files such as Web.config, which could contain sensitive database credentials and cryptographic key information.

Affected Version(s)

CentreStack 0

References

https://www.centrestack.com/
product
https://www.vulncheck.com/advisories/centrestack-xxe-via-...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

PeterV @cfc security ltd
.