CVE-2026-112333: GFI Archiver < 15.14 Stored XSS via MailInsights.aspx
GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReportClick() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GFI Archiverto a version that resolves this vulnerability.Fixed in 15.14
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to GFI Archiver and able to configure a scheduled report in MailInsights. Exploitation requires supplying a malicious report name to /Archiver/MailInsights.aspx.
When does the injected script execute?
The payload is stored when the scheduled report is saved and executes in the browser of the user who created that report when they later view the MailInsights page. User interaction is therefore required after the malicious report name has been saved.
Which versions are affected?
GFI Archiver versions before 15.14 are affected. Updating to version 15.14 or later addresses the affected version range stated in the advisory.