CVE-2026-54366
Deferred Deferred - Pending Action

XXE Injection Vulnerability in CentreStack

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: VulnCheck

Description
CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated StorageConfig endpoint causing the server to fetch and parse attacker-controlled XML containing external DTD references, resulting in out-of-band file exfiltration of sensitive files such as Web.config, which may contain database credentials and cryptographic key material.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-08-20
AI Q&A
2026-07-30
EPSS Evaluated
2026-08-18
NVD
CVE-2026-54366
EUVD
EUVD-2026-51102

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
centrestack centrestack to 17.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54366 is an XML External Entity (XXE) injection vulnerability in CentreStack versions before 17.4. It allows unauthenticated attackers to exfiltrate arbitrary files by sending a malicious URL to the SharePoint storage configuration handler. The server parses attacker-controlled XML with external DTD references, enabling out-of-band file exfiltration of sensitive files like Web.config.

Detection Guidance

To detect this XXE vulnerability, monitor network traffic for suspicious requests to the unauthenticated StorageConfig endpoint. Check server logs for unusual XML parsing errors or outbound connections to external servers triggered by XML processing. Use tools like Burp Suite or OWASP ZAP to intercept and inspect XML payloads sent to the endpoint.

Impact Analysis

This vulnerability can allow attackers to steal sensitive files such as Web.config, which may contain database credentials or cryptographic keys. Since it requires no authentication or user interaction, any exposed CentreStack instance before version 17.4 is at risk of unauthorized file access and potential data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. A successful exploit may result in data breaches, triggering compliance violations, legal penalties, and reputational damage for affected organizations.

Mitigation Strategies

Immediately upgrade CentreStack to version 17.4 or later to patch the XXE flaw. If immediate upgrade is not possible, restrict access to the StorageConfig endpoint via network firewall rules or disable unauthenticated access. Review and remove sensitive files like Web.config from accessible directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54366. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart