module

Gladinet CentreStack/Triofox Path Traversal

Try Surface Command
Back to search
Disclosed
Apr 3, 2025
Created
Feb 4, 2026

Description

This module exploits a path traversal vulnerability (CVE-2025-11371) in
Gladinet CentreStack and Triofox that allows an unauthenticated attacker to read
arbitrary files from the server's file system.

The vulnerability exists in the `/storage/t.dn` endpoint which does not properly
sanitize the `s` parameter, allowing path traversal attacks. This can be used
to read sensitive files such as Web.config which contains the machineKey used for
ViewState deserialization attacks (CVE-2025-30406).

Gladinet CentreStack versions up to 16.10.10408.56683 are vulnerable.
Gladinet Triofox versions up to 16.10.10408.56683 are vulnerable.

Authors

Huntress Team
Valentin Lobstein [email protected]
Julien Voisin
jheysel-r7

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371
    msf auxiliary(gladinet_storage_path_traversal_cve_2025_11371) > show actions
        ...actions...
    msf auxiliary(gladinet_storage_path_traversal_cve_2025_11371) > set ACTION < action-name >
    msf auxiliary(gladinet_storage_path_traversal_cve_2025_11371) > show options
        ...show and set options...
    msf auxiliary(gladinet_storage_path_traversal_cve_2025_11371) > run
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today