CVE-2025-11371

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.  This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

92% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-25)

CISA KEV

listed 2025-11-04, due 2025-11-25

CWE

CWE-552

Published

2025-10-09

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

Affected

• gladinet:centrestack
• gladinet:triofox

References

• https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw
• https://www.centrestack.com/p/gce_latest_release.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11371

Check your stackJSON