CVE-2026-54366 in CentreStack
Summary
by MITRE • 07/30/2026
CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated StorageConfig endpoint causing the server to fetch and parse attacker-controlled XML containing external DTD references, resulting in out-of-band file exfiltration of sensitive files such as Web.config, which may contain database credentials and cryptographic key material.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability in CentreStack versions prior to 17.4 represents a critical xml external entity xxe injection flaw that fundamentally compromises the security posture of SharePoint storage configurations. This issue resides within the StorageConfig endpoint which operates without authentication requirements, creating an attack surface that allows any remote adversary to exploit the system's xml parsing capabilities. The vulnerability stems from insufficient input validation and sanitization within the server-side processing of xml data, specifically when handling external entity references in xml documents. Attackers can leverage this weakness by crafting malicious xml payloads containing external dtd references that instruct the vulnerable system to retrieve and process attacker-controlled resources from remote servers.
The technical exploitation mechanism relies on the server's xml parser automatically resolving external entities during document parsing, creating a pathway for out-of-band data exfiltration. When the StorageConfig endpoint receives a crafted request containing malicious xml with external entity declarations, the underlying xml processing library fetches referenced dtd files from attacker-controlled domains. This process enables the extraction of sensitive files from the target system's file system, particularly targeting configuration files such as web.config that contain critical credentials and cryptographic materials. The vulnerability effectively bypasses traditional access controls since no authentication is required to trigger the malicious parsing behavior.
The operational impact of this XXE vulnerability extends beyond simple information disclosure, as it provides attackers with access to sensitive configuration data that could enable further exploitation. Database connection strings, encryption keys, and other credential material stored in web.config files become immediately accessible to remote attackers who can leverage this information for lateral movement within the network infrastructure. The unauthenticated nature of the attack means that threat actors can exploit this vulnerability without requiring valid credentials or prior access to the system. This makes the vulnerability particularly dangerous as it can be exploited by anyone with network access to the affected CentreStack instance, potentially leading to complete system compromise and data breaches.
Security mitigations for this XXE vulnerability should focus on implementing strict xml parsing configurations that disable external entity resolution and dtd processing entirely. Organizations must ensure that all xml parsers within the application stack are configured to reject external references and prevent automatic resolution of remote resources. Input validation and sanitization mechanisms should be strengthened to prevent malicious xml content from reaching the parsing layer, while network segmentation and firewall rules can help limit access to the vulnerable StorageConfig endpoint. Additionally, implementing proper logging and monitoring around xml processing activities enables detection of potential exploitation attempts. This vulnerability aligns with CWE-611 (Improper Restriction of XML External Entity Reference) and represents a common attack pattern categorized under ATT&CK technique T1566.001 (Phishing via Social Media) and T1071.004 (Application Layer Protocol: DNS) when considering the out-of-band exfiltration methods used by attackers.