Executive brief
GFI Archiver, a solution used for archiving business emails and files, is vulnerable to a security flaw in its configuration settings. An authenticated user can inject malicious scripts into the SMTP server address field, which are then saved and executed in the browsers of other administrators who view the settings page. This could allow an attacker to perform unauthorized actions or steal session information from other users of the management console.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in GFI Archiver versions prior to 15.13. The flaw is located in the General Settings SMTP configuration within /Archiver/GeneralSettingsWizard.aspx. An authenticated attacker can submit a malicious payload via the SMTP server address parameter, which is processed by the GeneralSettingsWizard.SaveAllConfigSettings() function. Because the application fails to perform proper output encoding before storing and later displaying this data, the script executes in the context of any user who visits the General Settings page. This can lead to session hijacking or unauthorized administrative actions. The issue is resolved in version 15.13.
Affected products
- GFI Software Archiver before 15.13
Timeline
- 2026-07-23: disclosed
- 2026-07-23: advisory