CVE-2025-11371: Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability

CVE-2025-11371 is a files or directories accessible to external parties vulnerability in Gladinet CentreStack and Triofox. It allows unintended disclosure of system files to parties that should not have access. For IT and security teams, this matters because exposure of system files can reveal configuration details, credentials, or other sensitive data that attackers use to expand access or plan further compromise of file-sharing and remote-access environments.

Public detail is limited to the CWE-552 classification and the CISA description of unintended system-file disclosure. Confirm exact impact, affected builds, and exploitation conditions against the vendor advisory before treating any environment as safe or fully remediated.

How it works

The underlying weakness is CWE-552: Files or Directories Accessible to External Parties. In products of this class—enterprise file-sync, remote-access, and cloud-storage gateways—the software is expected to enforce strict path and permission checks so that only authorized users or processes can read system-level files and directories. When those controls fail, an external party can reach files that were never intended for remote or unauthenticated access.

An attacker abuses the flaw by requesting or traversing to locations that the application incorrectly treats as accessible. Because the vulnerability results in disclosure of system files, the immediate consequence is information leakage rather than direct code execution. The leaked material can include configuration data, logs, or other artifacts that lower the barrier for subsequent attacks. Specific request formats, authentication bypasses, or payload details are not provided in the available facts; treat any public proof-of-concept claims as unverified until matched against the vendor advisory.

Am I affected? How to find it in your systems

Gladinet CentreStack and Triofox are typically deployed as on-premises or hybrid file-sharing and remote-access servers that present web and client interfaces for document collaboration. They often sit at the edge of the network or in DMZs and may be reachable from the internet or partner networks.

• Inventory all hosts and virtual machines running CentreStack or Triofox by querying package inventories, configuration-management databases, and listening services that match the product’s known ports and process names.
• Identify both production and non-production instances, including any cloud-hosted or appliance-based deployments.
• Compare installed versions and build numbers against the list of fixed releases published in the vendor advisory; do not rely on version ranges that have not been confirmed by the vendor.
• Review access-control and path-mapping configuration for any directories that should be restricted to local or administrative use only.
• Examine web-server and application logs for anomalous requests that target system paths, unexpected file downloads, or access patterns originating from untrusted networks. Telemetry that shows successful retrieval of files outside normal user shares is a potential indicator of exploitation.

If the product is offered as a managed or cloud service, also follow any applicable BOD 22-01 guidance for cloud services when determining exposure.

How to remediate

The primary remediation is to apply the mitigations and updates supplied by the vendor. CISA’s required action is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Obtain the official advisory, identify the fixed release or configuration change that addresses CVE-2025-11371, and schedule deployment through your normal change process.

• After patching, re-validate that system directories are no longer reachable from external or unauthenticated contexts.
• Harden residual risk by enforcing least-privilege file-system permissions, removing unnecessary path mappings, and ensuring the application runs under a restricted service account.
• Confirm that any temporary work-arounds recommended by the vendor have been replaced by the permanent fix.

Document the remediation date and retain evidence of the applied update for audit and compliance purposes.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls appropriate to this class of access-control failure.

• Segment the affected hosts so that only trusted management networks and authenticated clients can reach the CentreStack or Triofox interfaces; block direct internet access where possible.
• Place a web-application firewall or reverse-proxy rule set in front of the service to deny requests that attempt to reach system paths or known sensitive locations; treat these rules as virtual patches and keep them updated as new indicators emerge.
• Disable any optional features, modules, or URL handlers that expose additional file-system access if the vendor documentation permits it without breaking core functionality.
• Increase monitoring: alert on anomalous file-access patterns, failed or successful requests for system files, and unusual outbound traffic from the servers.
• If mitigations remain unavailable or incomplete, plan to discontinue use of the product as directed by CISA until a secure configuration can be restored.

These measures lower risk but do not eliminate it; prioritize the official vendor fix.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to breaches in which system files and any sensitive data they contain are exfiltrated. Known ransomware use of CVE-2025-11371 is not documented in the available facts, yet information disclosure still enables follow-on compromise. Review logs for signs of unauthorized access, rotate any credentials or secrets that may have resided on the affected systems, and assess whether additional incident-response steps are warranted. You can also run a free exposure scan of your email addresses against known breach data sets to determine whether related accounts have already appeared in public dumps.