Gladinet · CentreStack and Triofox
CVE-2025-11371
Gladinet CentreStack and TrioFox Local File Inclusion Flaw
What it is
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.
This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
CISA: Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: November 25, 2025
More exploited flaws from Gladinet
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Dec 15, 2025 | Hard Coded Cryptographic | CentreStack and Triofox | High 7.1 | 53% |
| Nov 12, 2025 | Improper Access Control | Triofox | Critical 9.1 | 96% |
| Apr 8, 2025 | and Triofox Use of Hard-coded Cryptographic Key | CentreStack | Critical 9.0 | 94% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.