High severity7.5CISA KEVNVD Advisory· Published Oct 9, 2025· Updated Jun 17, 2026
CVE-2025-11371
CVE-2025-11371
Description
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.
This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
Affected products
5cpe:2.3:a:gladinet:centrestack:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:gladinet:centrestack:*:*:*:*:*:*:*:*range: <16.10.10408.56683
- (no CPE)range: <=16.7.10368.56560
- Range: 0
Patches
Vulnerability mechanics
References
3- www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flawnvdExploitThird Party Advisory
- www.centrestack.com/p/gce_latest_release.htmlnvdRelease Notes
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
2- SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active ExploitationThe Hacker News · Jul 2, 2026
- Hackers Exploit Unpatched SharePoint Servers to Deploy Ransomware and Custom BackdoorsCyber Security News · Jun 24, 2026