CVE-2025-11371: Gladinet CentreStack and Triofox unauthenticated local file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable file disclosure with confirmed in-the-wild exploitation, KEV listing and very high EPSS probability.

What it is

CentreStack and Triofox in default installation and configuration contain an unauthenticated local file inclusion flaw that allows unintended disclosure of system files. The issue affects all versions prior to and including 16.7.10368.56560, and exploitation has been observed in the wild.

Impact

An unauthenticated attacker can read arbitrary system files from the server, exposing configuration data, credentials or other sensitive content that can support further intrusion.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The flaw is present in the default installation and configuration, so exposed instances are directly at risk.

Exploitation

Exploitation has been observed in the wild, the CVE was added to CISA KEV on 2025-11-04, and EPSS gives a 30-day probability of 0.92137 (99.8th percentile). A public third-party advisory is tagged as containing an exploit.

What to do

• Upgrade CentreStack and Triofox to a version later than 16.7.10368.56560 per the vendor release notes.
• If patching is not immediately possible, apply the vendor's mitigations or discontinue use of the product, following CISA BOD 22-01 guidance for cloud services.
• Remove or restrict internet exposure of CentreStack and Triofox management interfaces until the upgrade is complete.
• Review file system and web server logs for anomalous access to system files from unauthenticated requests.
• Rotate credentials and secrets that may have been stored in files readable through the inclusion flaw.

Detection

• Hunt web and application logs for requests containing path traversal or file inclusion patterns against CentreStack and Triofox endpoints.
• Monitor for unauthenticated access to known sensitive system file paths from external source IPs.
• Alert on unexpected outbound connections or new processes spawned by the CentreStack or Triofox service following file reads.
• Correlate file access events on the host with web requests to identify reads of files outside the application directory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.