Zero-day in file-sharing software leads to RCE, and attacks are ongoing

Security research firm Huntress is warning all users of Gladinet's CentreStack and Triofox file-sharing tools to urgently apply an available mitigation, as a zero-day is being actively exploited and there's no patch available. Tracked as CVE-2025-11371 (severity 6.2), the local file inclusion vulnerability is the second bug …

[veti]

But don't patch?

Your teaser says you're not advocating patching. But your article neglects to say why.

[JessicaRabbit]

Re: But don't patch?

From TFA:

Security research firm Huntress is warning all users of Gladinet's CentreStack and Triofox file-sharing tools to urgently apply an available mitigation, as a zero-day is being actively exploited and *there's no patch available.*

[jezza99]

What is Glainet?

I’m so glad I don’t know the answer to that question

[Anonymous Coward]

What does it run on?

‘.. users are recommended to disable the "temp" handler within the Web.config file for UploadDownloadProxy located at "C:\Program Files (x86)\Gladinet Cloud Enterprise\UploadDownloadProxy\Web.config."’

[kmorwath]

Re: What does it run on?

The path itself show they have no clue how to properly deploy a web application under Windows. Nor any application, for the matter.

No surprise the web.config file wasn't hardened - but you can obtain the same results with bad .htaccess files or the like under Linux as well.

[sin]

People should learn once for all

"secure" and "VPN-free" don't go into the same sentence when we talk about "remote file access", or any other access to private data.

NO EXCEPTIONS!