CVE-2025-11371

The vulnerability present in the default installation and configuration of Gladinet CentreStack and TrioFox is characterized as an unauthenticated Local File Inclusion (LFI) flaw. This type of vulnerability allows an attacker to manipulate input parameters to include files from the server's filesystem. In this case, the flaw enables unauthorized access to sensitive system files, which could lead to the disclosure of critical information such as configuration files, user credentials, or other sensitive data stored on the server. The unauthenticated nature of this vulnerability means that an attacker does not need to be logged in or possess any special privileges to exploit it, significantly increasing the risk of exploitation.

Attack vectors for this vulnerability are relatively straightforward, as they often involve crafting specific HTTP requests that exploit the LFI flaw. An attacker could leverage this vulnerability by sending specially crafted requests to the affected applications, targeting file inclusion mechanisms that do not properly validate user input. For instance, if the application allows users to specify a file path without adequate sanitization, an attacker could manipulate this input to include sensitive files from the server. Exploitation scenarios may include accessing sensitive configuration files, which could reveal database credentials or API keys, or even executing arbitrary code if the included files contain executable scripts. The simplicity of this attack vector makes it particularly concerning, as it can be executed with minimal technical expertise and can be automated for mass exploitation.

The real-world impact of this vulnerability is significant, particularly for organizations that rely on Gladinet CentreStack and TrioFox for file management and sharing. The potential for unintended disclosure of system files poses a serious business risk, as it could lead to data breaches, loss of intellectual property, and reputational damage. Organizations may face regulatory scrutiny and financial penalties if sensitive data is exposed, especially if it involves personal information or proprietary business data. Moreover, the exploitation of this vulnerability has been observed in the wild, indicating that threat actors are actively seeking to exploit it, thereby increasing the urgency for organizations to address this issue.

To detect and mitigate this vulnerability, organizations should implement a multi-faceted approach. First, it is critical to ensure that all instances of Gladinet CentreStack and TrioFox are updated to the latest versions, as this will patch the vulnerability. Regularly reviewing and updating software is a fundamental practice in cybersecurity hygiene. Additionally, organizations should conduct thorough security assessments, including penetration testing and code reviews, to identify and remediate any potential vulnerabilities in their applications. Implementing web application firewalls (WAF) can also help detect and block malicious requests attempting to exploit the LFI flaw. Furthermore, employing input validation and output encoding practices can significantly reduce the risk of such vulnerabilities by ensuring that user inputs are properly sanitized before being processed by the application.

In conclusion, the unauthenticated Local File Inclusion vulnerability in Gladinet CentreStack and TrioFox presents a serious threat to organizations utilizing these products. The ease of exploitation, coupled with the potential for significant data exposure, underscores the importance of proactive security measures. By updating software, conducting regular security assessments, and implementing robust input validation, organizations can effectively mitigate the risks associated with this vulnerability and protect their sensitive data from unauthorized access.

CSURFACE threat intelligence has detected a marked escalation in exploitation activity targeting CVE-2025-11371, evidenced by the emergence of a new Metasploit module that facilitates unauthenticated path traversal attacks against Gladinet CentreStack and TrioFox. This development significantly lowers the technical barrier for adversaries to exploit the vulnerability, enabling broader and more automated attacks. Our telemetry indicates a sharp increase in detection events related to this exploit, underscoring a growing attacker interest and operationalization in the wild. Although the EPSS score has slightly decreased, it remains high and continues an upward trend over the past week, reflecting sustained exploitability and risk. The inclusion of this vulnerability in the KEV catalog further elevates its priority for defenders, signaling increased recognition of its potential impact. Collectively, these factors intensify the threat landscape, raising the urgency for organizations using affected versions to reassess their exposure and monitoring strategies. The risk level is now elevated to critical due to the combination of active exploitation, publicly available attack tools, and the vulnerability’s capacity to disclose sensitive configuration files that could facilitate secondary attacks.