CVE-2025-11371
Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability
Published Oct 9, 2025 · updated Oct 8, 2026 · Gladinet CentreStack and Triofox
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
Timeline
Detection, updates, and resolution for this record.
Oct 9, 2025 · Catalog
Detected
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
Nov 4, 2025 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Nov 25, 2025 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Oct 8, 2026 · Catalog
Updated
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Nov 25, 2025
Affected
- cpe gladinet/centrestackversion unspecified
- cpe gladinet/triofoxversion unspecified
- vendor Gladinet CentreStack and Triofoxversion unspecified
Sources
- CISA KEVCVE-2025-11371
Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.
cisa.gov - CVE.orgCVE-2025-11371
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-11371
30-day exploitation probability 92.1%
first.org - Metasploit Modulesauxiliary_gather/gladinet_storage_path_traversal_cve_2025_11371
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2025-11371
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladi
nvd.nist.gov