CVE Watch8 oct 2026

CVE-2025-11371

Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability

CVSS

7.5

Alto

EPSS

92.1%

p100

KEV

SÍ

4 nov 2025

Exploit Today

0-100

Publicado: 9 oct 2025 · Última mod.: 8 oct 2026 · CWE-552

EPSS · 30d

92.1%EPSS · 30 días92.1%

2026-09-172026-10-15

Ficha del catálogo KEV

Producto

Gladinet / CentreStack and Triofox

Vulnerabilidad

Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability

Añadido a KEV

4 nov 2025

Remediar antes de

25 nov 2025

Uso conocido en ransomware

Descripción resumida

Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://www.centrestack.com/p/gce_latest_release.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-11371

Descripción técnica

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1026958.2 ALT

21.8%

——7OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.2d CVE-2026-108070—

37.5%

——11A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal resources.15h CVE-2026-968575.5 MED

31.4%

——9Files or directories accessible to external parties in Windows Projected File System allows an authorized attacker to disclose information locally.2d CVE-2026-881376.5 MED

60.6%

——18Files or directories accessible to external parties in WebDAV allows an authorized attacker to disclose information over a network.2d CVE-2026-858406.5 MED

60.6%

——18Files or directories accessible to external parties in Windows Event Viewer allows an authorized attacker to disclose information over a network.2d CVE-2026-858125.5 MED

31.4%

——9Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally.2d