CVE-2026-48536: GFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspx
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload is stored by GeneralSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GFI Archiverto a version that resolves this vulnerability.Fixed in 15.13 - Compensating control
Restrict access to /Archiver/GeneralSettingsWizard.aspx (General Settings) to trusted users only (e.g., via authentication/authorization controls and/or network/ACL restrictions) to reduce the ability of authenticated attackers to inject payloads.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48536?
The severity of CVE-2026-48536 is rated as medium with a score of 5.4.
How do I fix CVE-2026-48536?
To fix CVE-2026-48536, upgrade GFI Archiver to version 15.13 or later.
What type of vulnerability is CVE-2026-48536?
CVE-2026-48536 is a stored cross-site scripting (XSS) vulnerability.
Who can exploit CVE-2026-48536?
Authenticated attackers can exploit CVE-2026-48536 by injecting arbitrary web scripts via the SMTP server address.
What impact does CVE-2026-48536 have on affected systems?
CVE-2026-48536 can lead to the execution of arbitrary scripts, potentially compromising user data and web application integrity.