CVE-2026-48537: GFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspx
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers to inject arbitrary web script or HTML via the excluded extensions parameter to /Archiver/FileArchiveAssistantWizard.aspx. The injected payload is stored by FileArchiveAssistantWizard.btnSaveClick() without output encoding and is executed in the browsers of users who subsequently view the File Archive Assistant settings page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GFI Archiverto a version that resolves this vulnerability.Fixed in 15.13 - Compensating control
Reduce risk by preventing or restricting authenticated access to /Archiver/FileArchiveAssistantWizard.aspx (e.g., limit access to trusted admin users/roles via authentication and authorization/portal access controls) until GFI Archiver is upgraded.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48537?
CVE-2026-48537 has a medium severity score of 5.4.
How do I fix CVE-2026-48537?
To fix CVE-2026-48537, update GFI Archiver to version 15.13 or later.
What type of vulnerability is CVE-2026-48537?
CVE-2026-48537 is a stored cross-site scripting (XSS) vulnerability.
What component of GFI Archiver is affected by CVE-2026-48537?
The vulnerability affects the File Archive Assistant configuration in GFI Archiver.
Who can exploit CVE-2026-48537?
CVE-2026-48537 can be exploited by authenticated attackers with access to the File Archive Assistant.