CVE-2026-48539: GFI Archiver < 15.13 Stored XSS via MailInsights.aspx
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReportClick() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GFI Archiverto a version that resolves this vulnerability.Fixed in 15.13 - Configuration
Ensure the scheduled report name saved via ReportScheduling.btnSaveReport_Click() is properly output-encoded when rendered in /Archiver/MailInsights.aspx so injected web script/HTML is not executed.
GFI Archiver (MailInsights scheduled report configuration) report name parameter handling/output encoding = output-encoded (no unencoded HTML/script storage)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48539?
CVE-2026-48539 has a medium severity score of 5.4.
How do I fix CVE-2026-48539?
To mitigate CVE-2026-48539, upgrade GFI Archiver to version 15.13 or later.
What type of vulnerability is CVE-2026-48539?
CVE-2026-48539 is a stored cross-site scripting (XSS) vulnerability.
Who can exploit CVE-2026-48539?
Authenticated attackers can exploit CVE-2026-48539 through the report name parameter in MailInsights.
What impact does CVE-2026-48539 have?
CVE-2026-48539 allows attackers to inject arbitrary web scripts or HTML, potentially compromising user sessions.