CVE-2026-48537

GFI Archiver before version 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.

GFI Archiver before version 15.13 has a stored XSS vulnerability in the default import settings. An authenticated attacker can inject arbitrary script or HTML via the configured folders parameter in /Archiver/ImportSettingsWizard.ashx. The injected payload is stored without output encoding and executed in the browsers of users viewing the default import settings.

GFI Archiver before version 15.13 has a stored XSS vulnerability in the General Settings SMTP configuration. An authenticated attacker can inject arbitrary script or HTML via the SMTP server address parameter in /Archiver/GeneralSettingsWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the General Settings page.

GFI Archiver before version 15.13 has a stored XSS vulnerability in the IMAP Server configuration. An authenticated attacker can inject arbitrary script or HTML via the server URL parameter in /Archiver/ImapServerWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the IMAP Server configuration page.

GFI Archiver before version 15.13 has a stored XSS vulnerability in the File History Retention Policy configuration. An authenticated attacker can inject arbitrary script or HTML via the policy name parameter in /Archiver/FAARetentionPolicyWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the File History Retention Policies page.

GFI Archiver before version 15.13 has a stored XSS vulnerability in the Retention Policy configuration. An authenticated attacker can inject arbitrary script or HTML via the policy name parameter in /Archiver/RetentionPolicyWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the Retention and Spam Policies page.

GFI Archiver before version 15.13 has a stored XSS vulnerability in the Classification Rules configuration. An authenticated attacker can inject arbitrary script or HTML via the rule name and email criteria parameters in /Archiver/CategorizationPolicyWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the Classification Rules page.

GFI Archiver before version 15.13 has a stored XSS vulnerability in the Call Home proxy server configuration. An authenticated attacker can inject arbitrary script or HTML via the proxy server address parameter in /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the General Settings Additional Settings page.