CVE-2026-48530
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to inject arbitrary web script or HTML via the rule name and email criteria parameters to /Archiver/CategorizationPolicyWizard.aspx. The injected payload is stored by CategorizationPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Classification Rules page.
Risk Assessment
An attacker can execute malicious script in other users' browsers, potentially leading to session theft or unauthorized actions on behalf of victims.
Recommendation
Update GFI Archiver to version 15.14 or later, and until then restrict access to Classification Rules configuration to trusted administrators.
Other vulnerabilities in GFI Archiver
See all- CVE-2026-112333Medium
GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.
- CVE-2026-48539Medium
GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.
- CVE-2026-48538Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the default import settings. An authenticated attacker can inject arbitrary script or HTML via the configured folders parameter in /Archiver/ImportSettingsWizard.ashx. The injected payload is stored without output encoding and executed in the browsers of users viewing the default import settings.
- CVE-2026-48537Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the File Archive Assistant configuration. An authenticated attacker can inject arbitrary script or HTML via the excluded extensions parameter in /Archiver/FileArchiveAssistantWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the File Archive Assistant settings.
- CVE-2026-48536Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the General Settings SMTP configuration. An authenticated attacker can inject arbitrary script or HTML via the SMTP server address parameter in /Archiver/GeneralSettingsWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the General Settings page.
- CVE-2026-48535Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the Call Home proxy server configuration. An authenticated attacker can inject arbitrary script or HTML via the proxy server address parameter in /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the General Settings Additional Settings page.
- CVE-2026-48534Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the IMAP Server configuration. An authenticated attacker can inject arbitrary script or HTML via the server URL parameter in /Archiver/ImapServerWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the IMAP Server configuration page.
- CVE-2026-48532Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the File History Retention Policy configuration. An authenticated attacker can inject arbitrary script or HTML via the policy name parameter in /Archiver/FAARetentionPolicyWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the File History Retention Policies page.
- CVE-2026-48531Medium
GFI Archiver before version 15.13 has a stored XSS vulnerability in the Retention Policy configuration. An authenticated attacker can inject arbitrary script or HTML via the policy name parameter in /Archiver/RetentionPolicyWizard.aspx. The injected payload is stored without output encoding and executed in the browsers of users viewing the Retention and Spam Policies page.
Original NVD description (English source)
GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to inject arbitrary web script or HTML via the rule name and email criteria parameters to /Archiver/CategorizationPolicyWizard.aspx. The injected payload is stored by CategorizationPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Classification Rules page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS