Critical Directory Disclosure Vulnerability (CVE‑2025‑11371) in Gladinet CentreStack and Triofox
What It Is — Gladinet CentreStack and Triofox expose internal files or directories to unauthenticated external parties. The flaw stems from an overly permissive path‑validation routine that allows an attacker to enumerate and download system files.
Exploitability — The vulnerability is remotely exploitable without authentication. No public exploit code has been released, but the attack surface is trivial (simple HTTP request). The vendor‑assigned CVSS score is 7.5 (High).
Affected Products — Gladinet CentreStack (file‑sync & share platform) and Triofox (cloud‑based file gateway).
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – The issue shows how a missing “least‑privilege” guardrail can break the control objective of restricting file access to authorized users only.
- Audit‑ready evidence – Continuous monitoring of file‑access logs and configuration drift provides the defensible evidence auditors expect under NIST CSF 2.0.
- Supply‑chain confidence – Customers increasingly demand proof that third‑party SaaS providers enforce strict directory permissions before they can be trusted with sensitive data.
Recommended Actions
- Apply Gladinet’s latest security patch for CVE‑2025‑11371.
- Conduct an immediate permission review of all shared folders and gateways; enforce least‑privilege defaults.
- Enable detailed access‑logging and integrate logs into a SIEM for continuous monitoring.
- Map the finding to the “Access Control – Restrict unauthorized file access” control area and capture remediation evidence for audit purposes.
Source: CISA KEV – CVE‑2025‑11371