CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized interpolation of the Field parameter directly into SQL query strings to write arbitrary files to the server filesystem via PostgreSQL lo_from_bytea() and lo_export() functions, enabling remote code execution.
CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the static shared encryption key to forge identifiers for any user GUID, including the system-wide cluster settings account, enabling enumeration of hosted tenant domains and administrator identities.
CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated StorageConfig endpoint causing the server to fetch and parse attacker-controlled XML containing external DTD references, resulting in out-of-band file exfiltration of sensitive files such as Web.config, which may contain database credentials and cryptographic key material.
CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious StorageConfigure parameter to the jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn endpoints to trigger InternalImportAdUserByUPN(), causing GladinetCloudMonitor.exe to invoke the NetUserAdd Windows API with attacker-controlled credentials and create arbitrary directories on the server filesystem.
CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit the lack of input sanitization in the custom session serialization format to inject a resellerid session variable, bypassing the IsValidRSession authentication check and gaining unauthorized access to management pages.
CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt() and AccessTicket.Decrypt() across all installations. Attackers can use the hardcoded key to craft valid x-glad-auth headers and call privileged API endpoints such as acquiretenantbackuptoken to obtain a domain administrator IdentityTicket, enabling a complete unauthenticated remote code execution chain.
CVE-2026-8359 is a high-severity vulnerability in Gladinet Triofox caused by a NULL pointer dereference. The issue arises when processing requests with URL paths starting with /status or /sysinfo, which require loading the WOSHttpStatusModule.dll. Since this DLL is missing from the installation, the function pointer to WOSBin_LoadHttpModule is set to NULL, leading to a call at address 0 and causing a denial of service.
CVE-2026-8360 is a high-severity vulnerability in Gladinet Triofox involving a NULL pointer dereference. The issue arises when function calls to WOSCommonUtil.dll! WOSSysInfoGetDeviceInterface() return a NULL pointer if no user is logged into the Triofox Server Agent Management Console. This NULL pointer is not checked before being dereferenced in various DLLs, potentially causing a denial of service. The vulnerability has a CVSS score of 7.5, indicating a significant impact on availability without affecting confidentiality or integrity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-8361 is a high-severity path traversal vulnerability in Gladinet Triofox affecting the WOSDefaultHttpModule.dll component when processing URL paths starting with /woshome. This vulnerability allows an unauthenticated attacker to access files outside the intended directory structure. The vulnerability has a CVSS score of 7.5, indicating significant confidentiality impact but no integrity or availability impact. There is no confirmed patch or official remediation available at this time, and no known exploits are reported in the wild.
CVE-2026-8362 is a critical stack-based buffer overflow vulnerability in Gladinet Triofox. It occurs in the WOSDefaultHttpModule.dll component when processing a long URL path starting with /woshome. The vulnerability has a CVSS 3.1 score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available. There are no known exploits in the wild at this time.
CVE-2026-8363 is a critical stack-based buffer overflow vulnerability in Gladinet Triofox, specifically in the WOSDeviceDropFolder.dll component when processing a long URL path starting with /resources:. The vulnerability has a CVSS score of 9.8, indicating high severity with potential for complete confidentiality, integrity, and availability compromise. No patch or official remediation guidance is currently available, and no known exploits in the wild have been reported. Users should monitor vendor advisories for updates.
CVE-2026-8364 is a critical vulnerability in Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe) that lacks authentication for critical functions accessed via specific HTTP URL paths. The service listens on TCP port 7878 and processes remote HTTP requests to paths such as /resources, /status, /sysinfo, /woshome, /Settings, /schedule, and /DavCache without requiring authentication. This allows unauthenticated remote attackers to potentially gain full control over the service. The vulnerability has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available, and no known exploits have been reported in the wild.
Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.
A critical vulnerability in Gladinet's Triofox file-sharing platform, CVE-2025-12480, allowed unauthenticated access to configuration pages, enabling arbitrary payload execution. Threat actor UNC6485 exploited this flaw as early as August 24, 2025, bypassing authentication and chaining it with anti-virus feature abuse for code execution. The vulnerability affected Triofox version 16.4.10317.56372 and was patched in version 16.7.10368.56560. Attackers created admin accounts, deployed remote access tools, conducted reconnaissance, and attempted privilege escalation. They used Zoho UEMS, Zoho Assist, and Anydesk for remote access, and set up encrypted tunnels for C2 communication. The exploit chain involved HTTP host header manipulation and abuse of the built-in anti-virus feature to execute malicious scripts.
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.
This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
