CVE-2025-11371

7.5

HIGH CVSS 3.1

Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability - [Actively Exploited]

Description

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560

INFO

Published Date :

Oct. 9, 2025, 5:15 p.m.

Last Modified :

Nov. 5, 2025, 2:32 p.m.

Remotely Exploit :

Yes !

Source :

5dacb0b8-2277-4717-899c-254586fe4912

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Nov 25, 2025 | 4 days left

Alert Date: Nov 04, 2025 | 16 days ago

Description :

Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

https://www.centrestack.com/p/gce_latest_release.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-11371

Affected Products

The following products are affected by CVE-2025-11371 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Gladinet	centrestack
2	Gladinet	triofox

: Total Affected Vendor : 1 | Products : 2

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Version	Severity	Source
CVSS 3.1	MEDIUM	134c704f-9b21-4f2e-91b3-4a467353bcc0
CVSS 3.1	MEDIUM	134c704f-9b21-4f2e-91b3-4a467353bcc0
CVSS 3.1	HIGH	134c704f-9b21-4f2e-91b3-4a467353bcc0

Solution

Update Gladinet CentreStack and TrioFox to the latest version to fix file inclusion.

Update Gladinet CentreStack and TrioFox to the patched version.
Apply vendor-provided security patches.
Remove default configurations.
Review system file access controls.

Public PoC/Exploit Available at Github

CVE-2025-11371 has a 7 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-11371.

URL	Resource
https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw	Exploit Third Party Advisory
https://www.centrestack.com/p/gce_latest_release.html	Release Notes
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11371	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-11371 is associated with the following CWEs:

CWE-552: Files or Directories Accessible to External Parties

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-11371 weaknesses.

CAPEC-150: Collect Data from Common Resource Locations Collect Data from Common Resource Locations CAPEC-639: Probe System Files Probe System Files

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

NetVanguard-cmd/CVE-2025-11371

None

Updated: 1 month ago

4 stars 0 fork 0 watcher

Born at : Oct. 15, 2025, 2:10 p.m. This repo has been linked 2 different CVEs too.

callinston/CVE-2025-11371

None

Updated: 1 month, 1 week ago

0 stars 0 fork 0 watcher

Born at : Oct. 11, 2025, 7:20 p.m. This repo has been linked 2 different CVEs too.

lap1nou/CVE-2025-11371

CVE-2025-11371 PoC, credit goes to Huntress, https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw

Python

Updated: 1 month ago

0 stars 0 fork 0 watcher

Born at : Oct. 11, 2025, 6 p.m. This repo has been linked 1 different CVEs too.

rxerium/CVE-2025-11371

Detection for CVE-2025-11371

nuclei zero-day gladinet

Updated: 1 month ago

5 stars 0 fork 0 watcher

Born at : Oct. 10, 2025, 10:26 a.m. This repo has been linked 1 different CVEs too.

DevGreick/devgreick

None

Python

Updated: 4 days, 15 hours ago

1 stars 0 fork 0 watcher

Born at : Oct. 29, 2024, 8:10 p.m. This repo has been linked 10 different CVEs too.

rxerium/stars

A list of all of my starred repos, automated using Github Actions 🌟

github-actions stars

Updated: 2 weeks, 5 days ago

0 stars 0 fork 0 watcher

Born at : Jan. 4, 2023, 11:20 a.m. This repo has been linked 30 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 4 days, 14 hours ago

7382 stars 1217 fork 1217 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 824 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-11371 vulnerability anywhere in the article.

BleepingComputer

Hackers abuse Triofox antivirus feature to deploy remote access tools

Hackers exploited a critical vulnerability and the built-in antivirus feature in Gladinet's Triofox file-sharing and remote-access platform to achieve remote code execution with SYSTEM privileges. The ...

Published Date: Nov 11, 2025 (1 week, 1 day ago)

Help Net Security

Attackers exploited another Gladinet Triofox zero-day (CVE-2025-12480)

Attackers have exploited a now-fixed vulnerability (CVE-2025-12480) in the Gladinet Triofox secure file sharing and remote access platform while it was still a zero-day, Mandiant revealed on Monday. C ...

Published Date: Nov 11, 2025 (1 week, 2 days ago)

The Hacker News

Hackers Exploiting Triofox Flaw to Install Remote Access Tools via Antivirus Feature

Nov 10, 2025Ravie LakshmananVulnerability / Incident Response Google's Mandiant Threat Defense on Monday said it discovered n-day exploitation of a now-patched security flaw in Gladinet's Triofox fi ...

Published Date: Nov 10, 2025 (1 week, 2 days ago)

Help Net Security

Week in review: Cisco fixes critical UCCX flaws, November 2025 Patch Tuesday forecast

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Securing real-time payments without slowing them down In this Help Net Security interview, Arun Singh, ...

Published Date: Nov 09, 2025 (1 week, 4 days ago)

CybersecurityNews

CISA Warns of Gladinet CentreStack and Triofox Files Vulnerability Exploited in Attacks

The Cybersecurity and Infrastructure Security Agency has issued a critical warning regarding a newly identified vulnerability affecting Gladinet CentreStack and Triofox platforms. The flaw, tracked as ...

Published Date: Nov 06, 2025 (2 weeks ago)

BleepingComputer

CISA warns of critical CentOS Web Panel bug exploited in attacks

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is warning that threat actors are exploiting a critical remote command execution flaw in CentOS Web Panel (CWP). The agency has added the ...

Published Date: Nov 05, 2025 (2 weeks ago)

Help Net Security

Critical Control Web Panel vulnerability is actively exploited (CVE-2025-48703)

On Tuesday, CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2025-11371, which affects Gladinet’s CentreStack and Triofox file-sharing and remote access platforms, an ...

Published Date: Nov 05, 2025 (2 weeks, 1 day ago)

The Hacker News

CISA Adds Gladinet and CWP Flaws to KEV Catalog Amid Active Exploitation Evidence

Nov 05, 2025Ravie LakshmananVulnerability / Network Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two security flaws impacting Gladinet and Control Web P ...

Published Date: Nov 05, 2025 (2 weeks, 1 day ago)

Daily CyberSecurity

CISA KEV Alert: Two Critical Flaws Under Active Exploitation, Including Gladinet LFI/RCE and CWP Admin Takeover

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities—CVE-2025-11371 in Gladinet CentreStack and Triofox, and CVE-2025-48703 in Control Web Panel (CWP)—to ...

Published Date: Nov 05, 2025 (2 weeks, 1 day ago)

Daily CyberSecurity

Critical WooCommerce Plugin Flaw (CVE-2025-12493, CVSS 9.8) Allows Unauthenticated RCE, 100,000+ Sites Affect

A critical-severity Local File Inclusion (LFI) flaw in the popular WordPress plugin ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) al ...

Published Date: Nov 05, 2025 (2 weeks, 1 day ago)

Daily CyberSecurity

CVE-2025-64095: Critical CVSS 10.0 Flaw in DNN Platform Allows Unauthenticated Website Overwrite

The DNN Platform, a leading open-source Content Management System (CMS) in the Microsoft ecosystem, is urging its global user base of over 750,000 websites to update immediately following the disclosu ...

Published Date: Oct 31, 2025 (2 weeks, 6 days ago)

Daily CyberSecurity

Progress Patches High-Severity Vulnerability in MOVEit Transfer AS2 Module (CVE-2025-10932)

Progress Software Corporation has issued a security advisory warning of a high-severity vulnerability in its MOVEit Transfer managed file transfer product. Tracked as CVE-2025-10932 and rated CVSS 8.2 ...

Published Date: Oct 31, 2025 (2 weeks, 6 days ago)

Daily CyberSecurity

OpenAI Releases GPT-OSS-SafeGuard Models for Customizable AI Safety

Earlier in 2025, OpenAI released its own open-source artificial intelligence models, namely GPT-OSS-20B and GPT-OSS-120B, both of which demonstrated superior reasoning performance compared to many exi ...