What is the CVSS score of CVE-2025-11371?

CVE-2025-11371 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 92.1%.

Which versions of Gladinet CentreStack are affected by CVE-2025-11371?

Gladinet's CentreStack and TrioFox enterprise file-sharing platforms (through version 16.7.10368.56560) contain an unpatched flaw that lets an attacker reach into the underlying server and read…

Is there a public PoC exploit available for CVE-2025-11371?

Yes, a public proof-of-concept exploit is available for CVE-2025-11371. Prioritise patching immediately. EPSS: 92.1%.

How to fix or mitigate CVE-2025-11371?

Within the first 24 hours, treat every CentreStack and TrioFox instance at or below version 16.7.10368.56560 as exposed: inventory all internet-facing and internal deployments, and where business operations permit, take them off the public internet or restrict access to trusted source ranges via firewall or VPN allow-lists; enable and forward verbose web and application logs to the SIEM, and hunt for path-traversal and local-file-inclusion patterns (e.g., encoded ../ sequences, absolute file paths in query parameters, and requests targeting configuration or credential files) across the last 30 days. Within 7 days, if the system cannot be isolated, place it behind a reverse proxy or WAF configured to normalize and block traversal payloads, enforce an allow-list of expected request shapes, apply the principle of least privilege to the service account and file system permissions on the host, and confirm no default administrative credentials remain in use; run a forensic review of any host that logged suspicious file-read activity and rotate any credentials or secrets that may have been readable from those systems. Within 30 days, open a formal escalation with Gladinet to obtain a committed fix timeline and an interim vendor-supported mitigation, and if none is forthcoming, evaluate and begin migration to an alternative EFSS platform or a hardened architecture segment; only return the affected versions to full production once a fixed build above 16.7.10368.56560 is released and deployed, followed by re-validation that the exposure path is closed.

Gladinet CentreStack CVE-2025-11371

HIGH

Files or Directories Accessible to External Parties (CWE-552)

2025-10-09 5dacb0b8-2277-4717-899c-254586fe4912

Information Disclosure Path Traversal Centrestack Triofox Gladinet

7.5

CVSS 3.1 · Vendor: 5dacb0b8-2277-4717-899c-254586fe4912

Severity by source

Vendor (5dacb0b8-2277-4717-899c-254586fe4912) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Default-config LFI is network-reachable and unauthenticated with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is arbitrary system-file disclosure only, so C:H and I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (5dacb0b8-2277-4717-899c-254586fe4912).

CVSS VectorVendor: 5dacb0b8-2277-4717-899c-254586fe4912

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 14:40 vuln.today

tag: Gladinet added

Analysis Generated

Oct 08, 2026 - 14:01 vuln.today

Added to CISA KEV

Oct 08, 2026 - 13:31 CISA

CVE Published

Oct 09, 2025 - 17:15 cve.org

HIGH 7.5

DescriptionCVE.org

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.

This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560

AnalysisAI

Unauthenticated local file inclusion in Gladinet CentreStack and TrioFox (versions up to 16.7.10368.56560) allows remote attackers to read arbitrary system files, leading to sensitive information disclosure. This vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code and a 92.14% EPSS score, indicating critical risk. Default installations are immediately exploitable without authentication or user interaction.

Technical ContextAI

Gladinet CentreStack and TrioFox are web-based enterprise file sharing and synchronization platforms. The flaw is a local file inclusion (LFI) vulnerability classified as CWE-552 (Files or Directories Accessible to External Parties), stemming from inadequate validation of user-supplied file paths. This allows an attacker to traverse directories and include files outside the intended web root, disclosing sensitive system files such as configuration, credential, or log files. The CPE entries confirm the affected products: cpe:2.3:a:gladinet:centrestack:*:*:*:*:*:*:*:* and cpe:2.3:a:gladinet:triofox:*:*:*:*:*:*:*:*. The default configuration is vulnerable, meaning no special features need to be enabled.

RemediationAI

Upgrade Gladinet CentreStack and TrioFox to a version later than 16.7.10368.56560 immediately; the vendor advisory at https://www.centrestack.com/p/gce_latest_release.html should be consulted for the exact patched version. With confirmed active exploitation (CISA KEV) and publicly available exploit code, this is an urgent priority. If you cannot patch right away, restrict network access to the affected service using firewall rules or IP allowlisting, as the vulnerability is remotely exploitable without authentication. Additionally, consider deploying a web application firewall (WAF) with rules to block path traversal sequences (e.g., '../'), but be aware that this is a compensating control and may not fully prevent exploitation. Monitor logs for unusual file access attempts, as detailed in the Huntress blog (https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw).