Exploited Zero-Day: Gladinet/Triofox Flaw CVE-2025-11371 Allows RCE via LFI

Huntress has sounded the alarm over in-the-wild exploitation of a newly discovered Local File Inclusion vulnerability, tracked as CVE-2025-11371, in Gladinet CentreStack and Triofox products, which allows unauthenticated attackers to retrieve sensitive files and chain the obtained machine key with a ViewState deserialization exploit to achieve remote code execution.

The attack starts by exploiting the LFI to read arbitrary files, then using the Web.config file to extract the machine key, enabling the generation of valid serialized payloads for ViewState and bypassing authentication to run arbitrary commands on the target server.

According to Huntress, exploitation was first detected in three customer environments, with signs observed by Huntress’ Security Operations Center on 26 September 2025, and the exploitation involved a base64-encoded payload executed as a child process of a web server.

There is no official patch yet, and Huntress urges immediate mitigation by disabling the temp handler within the Web.config file of the UploadDownloadProxy component, at the path C:\Program Files (x86)\Gladinet Cloud Enterprise\UploadDownloadProxy\Web.config. This vulnerability follows Huntress’ earlier findings from April 2025 about CVE-2025-30406 in the same product line.