CVE-2025-11371

What it actually does

The flaw is an unauthenticated local file inclusion/path traversal issue in default Gladinet CentreStack and TrioFox installations. A remote attacker can craft HTTP requests that cause the application to read files from the underlying server filesystem outside the intended web-accessible paths. The primary impact is unintended disclosure of local system, application, and configuration files; depending on what is exposed, the attacker may obtain credentials, secrets, service configuration, product settings, or other data useful for follow-on compromise. It does not inherently provide code execution, but exposed secrets can materially increase the likelihood of lateral movement or administrative takeover.

Why it matters to the business

Compromise can expose sensitive server files from systems that broker enterprise file sharing and remote access workflows. That can lead to disclosure of configuration data, credentials, and operational details that enable further intrusion, data theft, or service disruption. The risk is urgent because exploitation has been observed in the wild, the EPSS probability is very high, and the vulnerability is listed in CISA KEV with a remediation due date of 2025-11-25. No ransomware use is indicated in the provided data, but active exploitation means internet-facing deployments should be treated as high priority.

How an attack unfolds

An attacker first identifies an internet-accessible Gladinet CentreStack or TrioFox server running an affected version. Without logging in, the attacker sends crafted HTTP requests containing traversal or local file inclusion sequences that attempt to reference files outside the intended application directory. If vulnerable, the server returns the contents of requested local files such as operating system files, application configuration, web server configuration, or files containing secrets. The attacker reviews the disclosed content to learn product version, filesystem layout, integration settings, keys, passwords, or tokens. Those details can then be used to deepen access, target administrative interfaces, attempt credential reuse, or support additional exploitation against the same server or connected services. Active exploitation has been reported against Gladinet CentreStack and TrioFox, so observed probing should be treated as potentially hostile rather than purely opportunistic scanning.

How to fix it

Upgrade Gladinet CentreStack and TrioFox to a vendor-supported fixed release later than 16.7.10368.56560; all versions up to and including 16.7.10368.56560 are affected. If an immediate upgrade is not possible, restrict external access to trusted networks or VPN, place the service behind a WAF or reverse proxy rule that blocks traversal and local file inclusion patterns, and disable unnecessary public exposure. Rotate any credentials, API keys, tokens, certificates, or integration secrets that may have been stored in local configuration files on exposed servers. Review vendor advisories for any product-specific hardening steps, post-upgrade cleanup, or configuration changes.

How to confirm the fix worked

Confirm every CentreStack and TrioFox deployment reports a version later than 16.7.10368.56560. Validate from both internal inventory and an external network perspective, because forgotten internet-facing instances are the highest-risk exposure. Test that unauthenticated traversal-style requests are rejected and do not return file contents; expected responses should be generic denial, not the contents of operating system or configuration files. Verify WAF or reverse proxy rules are active if used as temporary mitigation. Re-run vulnerability scans after patching and confirm no exposed asset is still identified as affected. Review logs from before and after remediation to ensure exploitation attempts no longer return HTTP 200 responses with abnormal response sizes.

Typical attack path

1. Discover exposed Gladinet CentreStack or TrioFox web interfaces through internet scanning, search engines, or asset enumeration.
2. Fingerprint the product and version through HTTP responses, page content, headers, or public resources.
3. Send unauthenticated crafted requests containing path traversal or local file inclusion payloads.
4. Request high-value local files such as operating system files, web server configuration, application configuration, and credential-bearing files.
5. Analyze returned file contents for secrets, usernames, passwords, tokens, encryption keys, internal paths, and integration details.
6. Use disclosed information for follow-on access, credential attacks, administrative targeting, or broader intrusion activity.

How to detect it

Review HTTP access logs from the application, IIS or equivalent web server logs, reverse proxy logs, WAF logs, load balancer logs, and EDR network telemetry for unauthenticated requests containing traversal sequences or requests for sensitive local files. Pay special attention to successful HTTP 200 responses, unusually large responses, repeated requests from the same source, requests with encoded dot-dot-slash patterns, and requests that occur before any authenticated session is established. Search for attempted access to operating system files, application configuration files, web server configuration files, credential stores, or backup/configuration artifacts. Correlate suspicious file-read attempts with later successful logins, administrative actions, abnormal file downloads, creation of new accounts, credential failures followed by successes, or connections from unfamiliar infrastructure. On Windows-hosted deployments, review IIS logs, Windows security logs if file auditing is enabled, application logs, and EDR file access events for reads of sensitive files by the web application worker process. Treat matches as potential exploitation because the vulnerability is actively exploited in the wild.

• ../
• ..\\
• ..%2f
• ..%2F
• %2e%2e%2f
• %2e%2e%5c
• %252e%252e%252f
• /etc/passwd
• /etc/shadow
• /etc/hosts
• /proc/self/environ
• C:\\Windows\\win.ini
• C:\\Windows\\System32\\drivers\\etc\\hosts
• boot.ini
• web.config
• appsettings.json
• connectionStrings
• Local File Inclusion
• path traversal

What your security team should do

• Immediately inventory all Gladinet CentreStack and TrioFox instances, prioritizing internet-facing systems.
• Patch or upgrade all affected deployments to a release later than 16.7.10368.56560 before the CISA KEV due date of 2025-11-25, and sooner for externally exposed systems.
• Temporarily restrict access to trusted IP ranges, VPN, or private networks until patching is complete.
• Deploy WAF or reverse proxy controls to block path traversal and local file inclusion payloads, including encoded variants.
• Hunt historical web, proxy, WAF, and application logs for unauthenticated requests containing traversal sequences or attempts to read sensitive files.
• If exploitation is suspected, rotate secrets stored on the affected server and review authentication logs for follow-on access using disclosed credentials.
• Monitor for additional vendor guidance and confirm backup, rollback, and incident response procedures are ready before upgrading production systems.