CVE-2026-48538: GFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashx
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configuration that allows authenticated attackers to inject arbitrary web script or HTML via the configured folders parameter to /Archiver/ImportSettingsWizard.ashx. The injected payload is stored by ImportSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Archive Assistant default import settings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GFI Archiverto a version that resolves this vulnerability.Fixed in 15.13 - Compensating control
Ensure only trusted/authorized authenticated users can access /Archiver/ImportSettingsWizard.ashx (where the configured folders parameter is submitted) to limit who can inject the stored XSS payload.
Event History
Frequently Asked Questions
What types of attacks are possible with CVE-2026-48538?
CVE-2026-48538 allows authenticated attackers to perform stored cross-site scripting (XSS) attacks by injecting arbitrary web scripts or HTML.
What is the severity rating of CVE-2026-48538?
CVE-2026-48538 has a severity rating of medium, with a score of 5.4.
How can I mitigate the risk of CVE-2026-48538?
To mitigate CVE-2026-48538, upgrade GFI Archiver to version 15.13 or later to eliminate the stored XSS vulnerability.
Who is affected by CVE-2026-48538?
CVE-2026-48538 affects users of GFI Archiver versions prior to 15.13.
What component of GFI Archiver is vulnerable in CVE-2026-48538?
The vulnerability in CVE-2026-48538 resides in the ImportSettingsWizard.ashx component of GFI Archiver.