CVE-2025-11371

7.5

HIGH CVSS 3.1

Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability - [Actively Exploited]

Description

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560

INFO

Published Date :

Oct. 9, 2025, 5:15 p.m.

Last Modified :

Nov. 5, 2025, 2:32 p.m.

Remotely Exploit :

Yes !

Source :

5dacb0b8-2277-4717-899c-254586fe4912

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Nov 25, 2025 | 18 days left

Alert Date: Nov 04, 2025 | 2 days ago

Description :

Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

https://www.centrestack.com/p/gce_latest_release.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-11371

Affected Products

The following products are affected by CVE-2025-11371 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Gladinet	centrestack
2	Gladinet	triofox

: Total Affected Vendor : 1 | Products : 2

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Version	Severity	Source
CVSS 3.1	MEDIUM	134c704f-9b21-4f2e-91b3-4a467353bcc0
CVSS 3.1	MEDIUM	134c704f-9b21-4f2e-91b3-4a467353bcc0
CVSS 3.1	HIGH	134c704f-9b21-4f2e-91b3-4a467353bcc0

Solution

Update Gladinet CentreStack and TrioFox to the latest version to fix file inclusion.

Update Gladinet CentreStack and TrioFox to the patched version.
Apply vendor-provided security patches.
Remove default configurations.
Review system file access controls.

Public PoC/Exploit Available at Github

CVE-2025-11371 has a 8 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-11371.

URL	Resource
https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw	Exploit Third Party Advisory
https://www.centrestack.com/p/gce_latest_release.html	Release Notes
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11371	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-11371 is associated with the following CWEs:

CWE-552: Files or Directories Accessible to External Parties

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-11371 weaknesses.

CAPEC-150: Collect Data from Common Resource Locations Collect Data from Common Resource Locations CAPEC-639: Probe System Files Probe System Files

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

NetVanguard-cmd/CVE-2025-11371

None

Updated: 2 weeks, 6 days ago

4 stars 0 fork 0 watcher

Born at : Oct. 15, 2025, 2:10 p.m. This repo has been linked 2 different CVEs too.

callinston/CVE-2025-11371

None

Updated: 3 weeks, 5 days ago

0 stars 0 fork 0 watcher

Born at : Oct. 11, 2025, 7:20 p.m. This repo has been linked 2 different CVEs too.

lap1nou/CVE-2025-11371

CVE-2025-11371 PoC, credit goes to Huntress, https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw

Python

Updated: 2 weeks, 6 days ago

0 stars 0 fork 0 watcher

Born at : Oct. 11, 2025, 6 p.m. This repo has been linked 1 different CVEs too.

rxerium/CVE-2025-11371

Detection for CVE-2025-11371

nuclei zero-day gladinet

Updated: 3 weeks, 2 days ago

5 stars 0 fork 0 watcher

Born at : Oct. 10, 2025, 10:26 a.m. This repo has been linked 1 different CVEs too.

CryptoGenNepal/CVE-KEV-RSS

CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild and CryptoGen Nepal aims to simplify this for the general public in a more understandable way as well as in a format that can be easily integrated into their threat intelligence systems.

cve json rss cgn cisa kev

Python HTML

Updated: 1 day, 10 hours ago

2 stars 1 fork 1 watcher

Born at : Feb. 16, 2025, 5:21 p.m. This repo has been linked 2 different CVEs too.

DevGreick/devgreick

None

Python

Updated: 14 hours, 14 minutes ago

1 stars 0 fork 0 watcher

Born at : Oct. 29, 2024, 8:10 p.m. This repo has been linked 10 different CVEs too.

rxerium/stars

A list of all of my starred repos, automated using Github Actions 🌟

github-actions stars

Updated: 5 days, 18 hours ago

0 stars 0 fork 0 watcher

Born at : Jan. 4, 2023, 11:20 a.m. This repo has been linked 30 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 13 hours, 43 minutes ago

7367 stars 1216 fork 1216 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 828 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-11371 vulnerability anywhere in the article.

CybersecurityNews

CISA Warns of Gladinet CentreStack and Triofox Files Vulnerability Exploited in Attacks

The Cybersecurity and Infrastructure Security Agency has issued a critical warning regarding a newly identified vulnerability affecting Gladinet CentreStack and Triofox platforms. The flaw, tracked as ...

Published Date: Nov 06, 2025 (14 hours, 10 minutes ago)

BleepingComputer

CISA warns of critical CentOS Web Panel bug exploited in attacks

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is warning that threat actors are exploiting a critical remote command execution flaw in CentOS Web Panel (CWP). The agency has added the ...

Published Date: Nov 05, 2025 (1 day, 2 hours ago)

Help Net Security

Critical Control Web Panel vulnerability is actively exploited (CVE-2025-48703)

On Tuesday, CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2025-11371, which affects Gladinet’s CentreStack and Triofox file-sharing and remote access platforms, an ...

Published Date: Nov 05, 2025 (1 day, 7 hours ago)

The Hacker News

CISA Adds Gladinet and CWP Flaws to KEV Catalog Amid Active Exploitation Evidence

Nov 05, 2025Ravie LakshmananVulnerability / Network Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two security flaws impacting Gladinet and Control Web P ...

Published Date: Nov 05, 2025 (1 day, 14 hours ago)

Daily CyberSecurity

CISA KEV Alert: Two Critical Flaws Under Active Exploitation, Including Gladinet LFI/RCE and CWP Admin Takeover

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities—CVE-2025-11371 in Gladinet CentreStack and Triofox, and CVE-2025-48703 in Control Web Panel (CWP)—to ...

Published Date: Nov 05, 2025 (1 day, 19 hours ago)

Daily CyberSecurity

Critical WooCommerce Plugin Flaw (CVE-2025-12493, CVSS 9.8) Allows Unauthenticated RCE, 100,000+ Sites Affect

A critical-severity Local File Inclusion (LFI) flaw in the popular WordPress plugin ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) al ...

Published Date: Nov 05, 2025 (1 day, 20 hours ago)

Daily CyberSecurity

CVE-2025-64095: Critical CVSS 10.0 Flaw in DNN Platform Allows Unauthenticated Website Overwrite

The DNN Platform, a leading open-source Content Management System (CMS) in the Microsoft ecosystem, is urging its global user base of over 750,000 websites to update immediately following the disclosu ...

Published Date: Oct 31, 2025 (6 days, 19 hours ago)

Daily CyberSecurity

Progress Patches High-Severity Vulnerability in MOVEit Transfer AS2 Module (CVE-2025-10932)

Progress Software Corporation has issued a security advisory warning of a high-severity vulnerability in its MOVEit Transfer managed file transfer product. Tracked as CVE-2025-10932 and rated CVSS 8.2 ...

Published Date: Oct 31, 2025 (6 days, 20 hours ago)

Daily CyberSecurity

OpenAI Releases GPT-OSS-SafeGuard Models for Customizable AI Safety

Earlier in 2025, OpenAI released its own open-source artificial intelligence models, namely GPT-OSS-20B and GPT-OSS-120B, both of which demonstrated superior reasoning performance compared to many exi ...