CVE-2025-11371 is an unauthenticated local file inclusion vulnerability in Gladinet CentreStack and Triofox's default install: an attacker can abuse the GladinetStorage.TempDownload function to directory-traverse to arbitrary files without logging in, and Huntress observed real intrusions where attackers used this to steal the Web.config file's static machine keys and then forge ViewState payloads for remote code execution — the same class of attack pattern seen in other 2025 ViewState-deserialization incidents.
Vulnerability summary
7.5
High
92.1%
EPSS score (FIRST)
Yes
CISA KEV catalog
2025-10-09
Published
Vulnerability ID: CVE-2025-11371 · Source: CISA-ADP (Secondary score only, not NVD Primary)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Gladinet CentreStack | cpe:2.3:a:gladinet:centrestack:*:*:*:*:*:*:*:* | before 16.10.10408.56683 |
| Gladinet Triofox | cpe:2.3:a:gladinet:triofox:*:*:*:*:*:*:*:* | through 16.7.10368.56560 |
What this means
CVE-2025-11371 is a files-or-directories-accessible-to-external-parties vulnerability (CWE-552). NVD's description states: "In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560" (NVD).
The only CVSS data on record is a Secondary score submitted by CISA's Authorized Data Publisher program: CVSS v3.1 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. No NVD Primary metric has been published for this CVE, so this page reports the CISA-ADP figure honestly as not NVD-confirmed rather than attributing it to NVD (NVD).
Huntress, which first reported the flaw, traced the vulnerable code to the GladinetStorage.TempDownload function inside GSUploadDownloadProxy.dll: it lets an unauthenticated request bypass access controls and retrieve arbitrary files using directory-traversal characters. In observed intrusions, attackers used this to pull the application's Web.config file, extract the static ASP.NET machine keys it contains, and then forge ViewState payloads that CentreStack/Triofox deserialize into remote code execution — the same technique Huntress and other researchers have documented in a wider wave of 2025 ViewState-deserialization attacks against on-premises .NET web applications. Huntress reports it first observed exploitation impacting three customers, with attackers having discovered exposed instances through the FOFA internet-scanning search engine. Gladinet shipped the fix in CentreStack 16.10.10408.56683, released October 14, 2025; Huntress also documents an interim mitigation of disabling the temp handler in Web.config by removing the handler entry pointing to t.dn (Huntress).
CISA added CVE-2025-11371 to the Known Exploited Vulnerabilities catalog on 2025-11-04, with a required-action due date of 2025-11-25 (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.9214 (99.821th percentile), consistent with confirmed in-the-wild use against internet-facing instances (FIRST EPSS).
Because the practical impact runs through a leaked static machine key rather than a single patchable code path, CentreStack/Triofox operators should upgrade past 16.10.10408.56683 (CentreStack) and apply Gladinet's guidance for Triofox, then rotate any ASP.NET machine key that could have been exposed via Web.config and review logs for prior TempDownload-based file reads before assuming the instance is clean.
Evidence
- Unauthenticated local file inclusion in the default install of Gladinet CentreStack and Triofox allows unintended disclosure of system files; exploitation observed in the wild; affects all versions through 16.7.10368.56560. — NVD
- Only CVSS data on record is a CISA-ADP Secondary score, CVSS v3.1 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; no NVD Primary metric published. — NVD
- Root cause is the GladinetStorage.TempDownload function in GSUploadDownloadProxy.dll; attackers used it to steal Web.config machine keys for ViewState-deserialization RCE, with exploitation impacting three Huntress customers before the October 14, 2025 fix in CentreStack 16.10.10408.56683. — Huntress
- Added to the CISA Known Exploited Vulnerabilities catalog on 2025-11-04, required-action due date 2025-11-25. — CISA KEV
- EPSS score is 0.9214 (99.821th percentile) as of 2026-10-29. — FIRST EPSS
