CVE-2026-48534: GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by ImapServerWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the IMAP Server configuration page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GFI Archiverto a version that resolves this vulnerability.Fixed in 15.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48534?
The severity of CVE-2026-48534 is rated as medium with a score of 5.4.
How do I fix CVE-2026-48534?
To fix CVE-2026-48534, upgrade GFI Archiver to version 15.13 or later.
What type of vulnerability is CVE-2026-48534?
CVE-2026-48534 is a stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-48534?
Authenticated users of GFI Archiver versions prior to 15.13 are affected by CVE-2026-48534.
What can attackers do with CVE-2026-48534?
Attackers can inject arbitrary web scripts or HTML into the IMAP Server configuration.