CVE-2026-48530
MediumCVSS 5.4Summary
GFI Archiver before version 15.13 has a stored XSS vulnerability in the Classification Rules configuration. An authenticated attacker can inject arbitrary script or HTML via the rule name and email criteria parameters in /Archiver/CategorizationPolicyWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the Classification Rules page.
Risk Assessment
The risk involves malicious script execution in the context of other administrators' sessions, potentially leading to data theft, session hijacking, or further attacks within the system.
Recommendation
Immediately upgrade GFI Archiver to version 15.13 or later, which fixes this vulnerability.
Other vulnerabilities in GFI Archiver
See all- CVE-2026-48539Medium
GFI Archiver before version 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.
- CVE-2026-48538Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the default import settings. An authenticated attacker can inject arbitrary script or HTML via the configured folders parameter in /Archiver/ImportSettingsWizard.ashx. The injected payload is stored without output encoding and executed in the browsers of users viewing the default import settings.
- CVE-2026-48537Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the File Archive Assistant configuration. An authenticated attacker can inject arbitrary script or HTML via the excluded extensions parameter in /Archiver/FileArchiveAssistantWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the File Archive Assistant settings.
- CVE-2026-48536Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the General Settings SMTP configuration. An authenticated attacker can inject arbitrary script or HTML via the SMTP server address parameter in /Archiver/GeneralSettingsWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the General Settings page.
- CVE-2026-48534Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the IMAP Server configuration. An authenticated attacker can inject arbitrary script or HTML via the server URL parameter in /Archiver/ImapServerWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the IMAP Server configuration page.
- CVE-2026-48532Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the File History Retention Policy configuration. An authenticated attacker can inject arbitrary script or HTML via the policy name parameter in /Archiver/FAARetentionPolicyWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the File History Retention Policies page.
- CVE-2026-48531Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the Retention Policy configuration. An authenticated attacker can inject arbitrary script or HTML via the policy name parameter in /Archiver/RetentionPolicyWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the Retention and Spam Policies page.
- CVE-2026-48535Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the Call Home proxy server configuration. An authenticated attacker can inject arbitrary script or HTML via the proxy server address parameter in /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the General Settings Additional Settings page.
Original NVD description (English source)
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to inject arbitrary web script or HTML via the rule name and email criteria parameters to /Archiver/CategorizationPolicyWizard.aspx. The injected payload is stored by CategorizationPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Classification Rules page.