Executive brief
GFI Archiver, a solution used by businesses to archive and manage email and file history, contains a security flaw in its import settings configuration. An authenticated user can inject malicious scripts that are saved on the server and later executed in the browsers of other users, such as administrators. This could lead to unauthorized actions being performed on behalf of other users or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in GFI Archiver versions prior to 15.13. The flaw is located within the /Archiver/ImportSettingsWizard.ashx endpoint, specifically involving the 'configured folders' parameter. The root cause is the failure of the ImportSettingsWizard.SaveAllConfigSettings() function to perform proper output encoding before storing the data. An authenticated attacker can submit a malicious payload that is subsequently executed in the context of any user who views the Archive Assistant default import settings. This vulnerability is tracked as CVE-2026-48538 and has been addressed in version 15.13.
Affected products
- GFI Software Archiver before 15.13
Timeline
- 2026-07-23: disclosed
- 2026-07-23: advisory