CVE WatchOct 8, 2026

CVE-2025-11371

Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability

CVSS

7.5

High

EPSS

92.1%

p100

KEV

YES

Nov 4, 2025

Exploit Today

0-100

Published: Oct 9, 2025 · Last modified: Oct 8, 2026 · CWE-552

EPSS · 30d

92.1%EPSS · 30 days92.1%

2026-09-162026-10-14

KEV catalog record

Product

Gladinet / CentreStack and Triofox

Vulnerability

Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability

Added to KEV

Nov 4, 2025

Remediate by

Nov 25, 2025

Known ransomware use

Summary description

Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://www.centrestack.com/p/gce_latest_release.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-11371

Technical description

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1026958.2 HIG

—

——0OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.23h CVE-2026-108070—

—

——0A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal resources.1d CVE-2026-968575.5 MED

31.3%

——9Files or directories accessible to external parties in Windows Projected File System allows an authorized attacker to disclose information locally.2d CVE-2026-881376.5 MED

60.5%

——18Files or directories accessible to external parties in WebDAV allows an authorized attacker to disclose information over a network.2d CVE-2026-858406.5 MED

60.5%

——18Files or directories accessible to external parties in Windows Event Viewer allows an authorized attacker to disclose information over a network.2d CVE-2026-858125.5 MED

31.3%

——9Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally.2d