# CVE-2025-11371: CentreStack and TrioFox - Arbitrary File Read

> Live exploitation tracking for CVE-2025-11371 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-11371

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 6.2
- **Public exploit available:** Yes
- **Affected products:** Gladinet CentreStack and TrioFox
- **Weaknesses:** CWE-552 (Files or Directories Accessible to External Parties)
- **Tags:** file_sharing

## Description

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. 

This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560

## CrowdSec analysis

[CVE-2025-11371](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-11371) is a local file inclusion vulnerability in the default installation of Gladinet CentreStack and TrioFox, allowing unauthenticated attackers to access sensitive system files. This flaw, which has been actively exploited in the wild, could lead to unintended disclosure of confidential information and facilitate further attacks against affected systems.

CrowdSec has been tracking this vulnerability and its exploits since 29th of October 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2025-11371 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2025-11371 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2025-11371 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit this vulnerability by sending requests to URLs containing `/storage/t.dn` with the `s` parameter set to Windows-style path traversal sequences (e.g., `..%5C..%5C..%5C`) to access sensitive files such as `Web.config`.

## Timeline

- 2025-10-09: CVE Published. CVE-2025-11371 is published to NVD.
- 2025-10-29: Rule Released. CrowdSec releases a rule to detect CVE-2025-11371 exploitation attempts against the CrowdSec Network.
- 2025-11-04: CISA KEV. CVE-2025-11371 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-11-05: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-11371 for the first time.
- 2025-11-25: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11371.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-11371) follows observed exploitation activity for CVE-2025-11371. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.