Gladinet has released security updates for its CentreStack business solution to address a local file inclusion vulnerability (CVE-2025-11371) that threat actors have leveraged as a zero-day since late September. Researchers at cybersecurity platform Huntress disclosed the exploitation activity last week saying that the flaw was a bypass for mitigations Gladinet implemented for the deserialization vulnerability leading to remote code execution (RCE) identified as CVE-2025-30406. The local file inclusion (LFI) vulnerability enabled attackers to read the Web.config file on fully patched CentreStack deployments, extract the machine key, and then use it to exploit CVE-2025-30406. When Huntress alerted of the zero-day attacks Gladinet provided mitigations for customers and was in the process of developing a patch. The security update that addresses CVE-2025-11371 is now available in CentreStack version 16.10.10408.56683 and administrators are strongly recommended to install it. In an update to the original alert, Huntress shares more technical details on CVE-2025-11371 that include a minimal proof-of-concept exploit. The root cause of the LFI issue is a sanitization failure at the temp-download handler, reachable at /storage/t.dn, which accepts an 's=' parameter, leading to directory traversal. At the service runs as NT AUTHORITY\SYSTEM and resolves files relative to the temp folder, the flaw allows attackers to read any file the SYSTEM account can access, including Web.config, wh...
Gladinet fixes actively exploited zero-day in file-sharing software
BleepingComputer
·Bill Toulas
·Published Oct 16, 2025
·Updated
Affected Software
1 affected component
Gladinet CentreStack=16.10.10408.56683
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses the release of security updates by Gladinet to fix a zero-day vulnerability in their CentreStack file-sharing software.
2
What vulnerability is addressed in the Gladinet update?
The update addresses a local file inclusion vulnerability identified as CVE-2025-11371.
3
When was the zero-day vulnerability actively exploited?
The zero-day vulnerability has been actively exploited by threat actors since late September 2025.
4
Who disclosed the exploitation activity of the vulnerability?
The exploitation activity was disclosed by researchers at the cybersecurity platform Huntress.
5
What product is affected by the vulnerability mentioned in the article?
The affected product is Gladinet CentreStack.