CVE-2026-48535: GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored by CallHomeSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings Additional Settings page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GFI Archiverto a version that resolves this vulnerability.Fixed in 15.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48535?
CVE-2026-48535 has a medium severity score of 5.4.
How do I fix CVE-2026-48535?
To fix CVE-2026-48535, upgrade GFI Archiver to version 15.13 or later.
What type of vulnerability is CVE-2026-48535?
CVE-2026-48535 is a stored cross-site scripting (XSS) vulnerability.
What impact does CVE-2026-48535 have?
CVE-2026-48535 allows authenticated attackers to inject arbitrary web scripts or HTML.
Which software is affected by CVE-2026-48535?
CVE-2026-48535 affects GFI Archiver versions prior to 15.13.