CVE-2026-48532: GFI Archiver < 15.13 Stored XSS via FAARetentionPolicyWizard.aspx
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/FAARetentionPolicyWizard.aspx. The injected payload is stored by RetentionPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the File History Retention Policies page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GFI Archiverto a version that resolves this vulnerability.Fixed in 15.13 - Compensating control
Restrict access to /Archiver/FAARetentionPolicyWizard.aspx and the File History Retention Policies page to trusted users only until the upgrade to GFI Archiver 15.13 is applied, to limit the impact of stored XSS.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48532?
CVE-2026-48532 has a medium severity rating of 5.4.
How do I fix CVE-2026-48532?
To fix CVE-2026-48532, upgrade GFI Archiver to version 15.13 or later.
What type of vulnerability is CVE-2026-48532?
CVE-2026-48532 is a stored cross-site scripting (XSS) vulnerability.
Who can exploit CVE-2026-48532?
Authenticated attackers can exploit CVE-2026-48532 by injecting arbitrary web scripts or HTML.
What is affected by CVE-2026-48532?
CVE-2026-48532 specifically affects GFI Archiver versions prior to 15.13.