CVE-2025-11371
HIGH KEV NUCLEIGladinet CentreStack/Triofox Path Traversal
Title source: metasploitExploitation Summary
CVE-2025-11371 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 4, 2025. EIP tracks 2 public exploits from researchers including halilkirazkaya, lap1nou. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains functional exploit code for multiple CVEs, including remote file inclusion, path traversal, and unauthorized file deletion vulnerabilities. Each PoC includes specific HTTP requests or commands to exploit the vulnerabilities.
Description
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
Exploits (2)
The repository contains functional exploit code for multiple CVEs, including remote file inclusion, path traversal, and unauthorized file deletion vulnerabilities. Each PoC includes specific HTTP requests or commands to exploit the vulnerabilities.
This repository contains a functional exploit for CVE-2025-11371, leveraging a local file inclusion (LFI) vulnerability to extract decryption and validation keys from a web.config file, then using ysoserial.net to generate a malicious ViewState payload for remote code execution (RCE).
Nuclei Templates (1)
title:"CentreStack"
CentreStack - Login
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N