CVE-2025-11371: Unpatched zero-day in Gladinet CentreStack, Triofox under attack

Threat actors are exploiting a local file inclusion flaw tracked as CVE-2025-11371 in Gladinet CentreStack and Triofox, an unpatched zero-day that could let a local user access system files without authentication. The vulnerability enables remote code execution via a deserialization path once the attacker retrieves the machine key from Web.config, following exploitation of an unauthenticated local file inclusion flaw partly described in Huntress’ report.

CentreStack and Triofox are enterprise file-sharing and cloud storage solutions used to manage corporate files securely for remote work. Experts warn that mitigations exist, but the issue remains unpatched and, according to Huntress, at least three customers have already been targeted.

Gladinet has recommended a workaround, specifically disabling the temp handler in UploadDownloadProxy’s Web.config, though this may affect some platform functionality, and removing the highlighted line is said to mitigate the vulnerability until a patch is available.