What is GHSA-4cmj-5m56-fg8c?

GHSA-4cmj-5m56-fg8c is a security advisory published by GitHub Security Advisories with High severity. CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and...

Which CVE IDs does GHSA-4cmj-5m56-fg8c cover?

GHSA-4cmj-5m56-fg8c covers the following CVE IDs: CVE-2026-54368. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4cmj-5m56-fg8c?

GHSA-4cmj-5m56-fg8c has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-4cmj-5m56-fg8cHighCVSS 8.8

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and...

Vendor

GitHub Security Advisories

Published

July 30, 2026

Last Modified

July 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-54368 →

📋 Description

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized interpolation of the Field parameter directly into SQL query strings to write arbitrary files to the server filesystem via PostgreSQL lo_from_bytea() and lo_export() functions, enabling remote code execution.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-54368
https://www.centrestack.com
https://www.vulncheck.com/advisories/centrestack-sql-injection-via-x-glad-filter-header
https://github.com/advisories/GHSA-4cmj-5m56-fg8c