CVE-2026-48539
MediumCVSS 5.4Summary
GFI Archiver before version 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.
Risk Assessment
The risk is execution of scripts in the victim's browser, which could lead to session theft, redirection to malicious sites, or other harmful actions within the application context.
Recommendation
Update GFI Archiver to version 15.13 or later, which includes a fix encoding the output of the report name parameter.
Other vulnerabilities in GFI Archiver
See all- CVE-2026-48538Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the default import settings. An authenticated attacker can inject arbitrary script or HTML via the configured folders parameter in /Archiver/ImportSettingsWizard.ashx. The injected payload is stored without output encoding and executed in the browsers of users viewing the default import settings.
- CVE-2026-48537Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the File Archive Assistant configuration. An authenticated attacker can inject arbitrary script or HTML via the excluded extensions parameter in /Archiver/FileArchiveAssistantWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the File Archive Assistant settings.
- CVE-2026-48536Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the General Settings SMTP configuration. An authenticated attacker can inject arbitrary script or HTML via the SMTP server address parameter in /Archiver/GeneralSettingsWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the General Settings page.
- CVE-2026-48534Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the IMAP Server configuration. An authenticated attacker can inject arbitrary script or HTML via the server URL parameter in /Archiver/ImapServerWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the IMAP Server configuration page.
- CVE-2026-48532Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the File History Retention Policy configuration. An authenticated attacker can inject arbitrary script or HTML via the policy name parameter in /Archiver/FAARetentionPolicyWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the File History Retention Policies page.
- CVE-2026-48531Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the Retention Policy configuration. An authenticated attacker can inject arbitrary script or HTML via the policy name parameter in /Archiver/RetentionPolicyWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the Retention and Spam Policies page.
- CVE-2026-48530Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the Classification Rules configuration. An authenticated attacker can inject arbitrary script or HTML via the rule name and email criteria parameters in /Archiver/CategorizationPolicyWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the Classification Rules page.
- CVE-2026-48535Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the Call Home proxy server configuration. An authenticated attacker can inject arbitrary script or HTML via the proxy server address parameter in /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the General Settings Additional Settings page.
Original NVD description (English source)
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.