CVE-2026-8361: Gladinet Triofox Path Traversal in WOSDefaultHttpModule.dll

Synopsis

A path traversal vulnerability exists in Gladinet Triofox, specifically in the WOSDefaultHttpModule.dll component when processing URL paths that begin with /woshome. The flaw is reachable over the network with no authentication or user interaction required, as reflected in the CVSS vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation allows an attacker to read files outside the intended directory, disclosing sensitive data stored on the server. A patched-image rebuild at version 17.3.10565.57509 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network; an attacker must be able to send HTTP requests to the Triofox service to trigger the path traversal.

• AuthenticationNot required

  No credentials or session token are needed; the malicious request can be sent by any unauthenticated party.

• Victim interactionNot required

  No user action is required; the attacker sends a crafted request directly to the service without any victim involvement.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layout, or environmental prerequisites are needed to trigger the vulnerability.

Blast Radius

• An attacker reads files outside the intended web root by supplying a crafted /woshome URL path containing traversal sequences.
• Exposed files may include configuration files, credential stores, or other sensitive server-side data depending on the deployment layout.
• Because no authentication barrier exists, any internet-reachable Triofox instance is a viable target without prior access.