Unauthenticated Local File Inclusion in Gladinet CentreStack and Triofox
CISA: Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability
CVSS 3.1
7.5high
EPSS
92%p100
Published
()
KEV added
AI analysis
Gladinet CentreStack and Triofox, in their default installation and configuration, contain an unauthenticated local file inclusion flaw (CWE-552) that allows unintended disclosure of system files to remote attackers. The flaw requires no privileges or user interaction (CVSS 3.1: AV:N/PR:N/UI:N, 7.5 High), so any internet-facing deployment is directly reachable over the network. An attacker gains access to system files that should not be externally readable, and related reporting indicates active attacks have chained the flaw — including with Gladinet's hardcoded keys — toward unauthorized access, code execution, and deployment of remote access tools. All versions prior to and including 16.7.10368.56560 of both products are affected. Exploitation has been observed in the wild: the vulnerability was added to CISA's KEV on 2025-11-04 and carries a 92.1% EPSS probability of exploitation within 30 days.
What to do: Upgrade CentreStack and Triofox to a release newer than 16.7.10368.56560, and apply vendor mitigations per CISA BOD 22-01 requirements (federal agencies must mitigate or discontinue use of affected versions). Until patched, restrict internet exposure of the service and review logs for suspicious unauthenticated requests, unexpected file reads, new accounts, or signs of follow-on compromise such as remote-access tool installation. The Huntress write-up referenced in this record provides exploitation context for detection guidance; no exploit code is required to confirm patch status.
Affected
gladinet centrestack
All versions prior to and including 16.7.10368.56560
gladinet triofox
All versions prior to and including 16.7.10368.56560
Estimated exposure
moderate≈ thousands (10^3–10^4) of internet-facing CentreStack/Triofox server deployments; exact counts unknown — CentreStack and Triofox are self-hosted secure file-sharing/MFT gateways typically deployed by enterprises and MSPs as single internet-facing servers serving an organization's users, implying an order-of-magnitude exposure in the thousands…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
CISA Known Exploited Vulnerability
Affected
Gladinet CentreStack and Triofox
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA adds actively exploited SharePoint RCE CVE-2026-45659 (CVSS 8.8) to KEV; an August 11 update confirms ransomware groups are exploiting the flaw.
CVE-2026-45659 is a deserialization of untrusted data RCE in Microsoft SharePoint Server affecting Subscription Edition, 2019, and 2016, patched by Microsoft in May 2026. An authenticated attacker with at least Site Member permissions can execute code remotely over the network. CISA added the flaw to its KEV catalog on July 2 with a July 4 deadline for federal agencies, and on August 11 confirmed ransomware groups are exploiting it. Microsoft separately described Storm-2603 (Warlock ransomware) and an unrelated actor co-existing in one network, with initial access likely via the Gladinet Triofox flaw CVE-2025-11371 (CVSS 9.1).