CVE-2025-11371
Published: November 4, 2025
Official Description
Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.
CISA KEV Advisory
Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability
Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Risk Analysis
This flaw in Gladinet CentreStack and Triofox allows unauthorized access to system files, leading to unintended disclosure. With an EPSS score of 0.71001 and confirmed exploitation in CISA's KEV, this vulnerability poses a significant and urgent risk.
This vulnerability is actively being exploited in the wild. The nature of the flaw suggests it can be exploited remotely to access sensitive system files.
Organizations using Gladinet CentreStack and Triofox should apply all available patches and updates immediately. Reviewing and restricting file access permissions can also help mitigate potential data exposure.
Technical Analysis
CVE-2025-11371 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2025-11371 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Exploit & PoC Resources
All References (2)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2025-11371 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1