CVE-2026-54366 is an XML External Entity (XXE) injection vulnerability in Gladinet CentreStack before version 17.4. The flaw exists in the unauthenticated StorageConfig endpoint used for SharePoint storage configuration. An attacker can send a crafted request containing attacker-controlled XML with external DTD references, causing the server to fetch and parse this XML. This results in out-of-band exfiltration of arbitrary files from the server, including sensitive configuration files like Web.config that may hold database credentials and cryptographic keys. The vulnerability is remotely exploitable without authentication or user interaction and has a CVSS 4.0 score of 8.7 (high severity). No official patch or remediation guidance is currently provided.

Successful exploitation allows unauthenticated remote attackers to exfiltrate arbitrary files from the CentreStack server, potentially exposing sensitive configuration files containing database credentials and cryptographic key material. This can lead to further compromise of the affected system and connected infrastructure. The vulnerability does not require privileges or user interaction, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the StorageConfig endpoint and monitor for suspicious requests containing XML payloads. Consider network-level controls to limit exposure of the vulnerable service. Avoid exposing CentreStack management interfaces to untrusted networks.