CVE-2026-48530: GFI Archiver < 15.13 Stored XSS via CategorizationPolicyWizard.aspx
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to inject arbitrary web script or HTML via the rule name and email criteria parameters to /Archiver/CategorizationPolicyWizard.aspx. The injected payload is stored by CategorizationPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Classification Rules page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GFI Archiverto a version that resolves this vulnerability.Fixed in 15.13 - Compensating control
Restrict access to the Classification Rules / CategorizationPolicyWizard.aspx functionality to trusted users (authenticated access) until GFI Archiver is upgraded.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48530?
CVE-2026-48530 has a medium severity score of 5.4.
How do I fix CVE-2026-48530?
To fix CVE-2026-48530, upgrade GFI Archiver to version 15.13 or later.
What type of vulnerability is CVE-2026-48530?
CVE-2026-48530 is a stored cross-site scripting (XSS) vulnerability.
Who is impacted by CVE-2026-48530?
Authenticated users of GFI Archiver prior to version 15.13 are impacted by CVE-2026-48530.
What can attackers do with CVE-2026-48530?
Attackers can inject arbitrary web scripts or HTML through the Classification Rules configuration.