High severity · published Oct 9, 2025
CVE-2025-11371
Gladinet CentreStack and TrioFox Local File Inclusion Flaw
In wildKEV
7.5
CVSS
92.1%
EPSS
Yes
On KEV
Description
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.
This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)92.1% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 4, 2025
Federal remediation dueNov 25, 2025
Ransomware campaign useNot known
Affected products
Which versions
CA
CentreStack and TrioFox · Gladinet
through 16.7.10368.56560 · source: vendor, KEV
CE
Centrestack · Gladinet
before 16.10.10408.56683 · source: NVD
TR
Triofox · Gladinet
through 16.7.10368.56560 · source: NVD
In the news
VulnerabilityHigh
[CISA KEV] CVE-2025-11371: Gladinet CentreStack and Triofox - Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability
Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.
CACentreStack and TriofoxCVE-2025-11371
Nov 4, 2025·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11371
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11371
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
www.huntress.com
https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw
More from CentreStack and TrioFox
9.8
CVE-2025-14611
Gladinet CentreStack and TrioFox Hard Coded AES Keys