U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Gladinet CentreStack, and CWP Control Web Panel flaws to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added XWiki Platform, and Gladinet CentreStack, and CWP Control Web Panel flaws to its Known Exploited Vulnerabilities (KEV) catalog.
Below are the flaws added to the catalog:
- CVE-2025-11371 (CVSS score of 7.5) Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability
- CVE-2025-48703 (CVSS score of 9.0) CWP Control Web Panel OS Command Injection Vulnerability
Gladinet CentreStack and Triofox are enterprise file-sharing and cloud storage solutions designed for businesses:
- CentreStack: Provides a secure platform for file sharing, syncing, and collaboration, integrating on-premises storage with cloud access. It allows companies to offer cloud-like access to internal file servers while maintaining control over data.
- Triofox: Offers a hybrid cloud solution that enables secure remote access to existing Windows file shares and SMB/NFS storage. It includes features like file versioning, synchronization, and web/mobile access, without moving data from the company’s servers.
Both are used to manage corporate files securely while supporting remote work and collaboration.
Threat actors are exploiting the local File Inclusion (LFI) flaw CVE-2025-11371, a zero-day in Gladinet CentreStack and Triofox. A local user can exploit the issue to access system files without authentication.
Gladinet and Huntress have alerted customers to a workaround for the actively exploited CVE-2025-11371 flaw. The cybersecurity firm reported that at least three customers have been targeted so far.
The company recommends disabling the temp handler in UploadDownloadProxy’s Web.config to block exploitation of the vulnerability, though some platform functionality will be affected.
CVE-2025-48703 is an OS command injection vulnerability in CWP Control Web Panel, the researcher Maxime Rinaudo disclosed technical details in June 2025 after it was patched.
“This exploitation scenario has been tested on versions 0.9.8.1204 and 0.9.8.1188 on Centos7 and reported to CWP developers the 13th of May 2025 as CVE-2025-48703. It allows a remote attacker who knows a valid username on a CWP instance to execute pre-authenticated arbitrary commands on the server.” reads the report published by Rinaudo. “The vulnerability has been patched on latest version 0.9.8.1205 during June 2025.”
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by November 25, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
