Executive brief
GFI Archiver, a solution used by organizations to archive and manage email and file history, is vulnerable to a security flaw in its reporting module. An authenticated user can inject malicious scripts into report names, which then execute in the browser of other users viewing those reports. This could allow an attacker to perform unauthorized actions or steal session information from other employees using the system.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in GFI Archiver versions prior to 15.13. The flaw is located in the MailInsights scheduled report configuration, specifically within the 'report name' parameter handled by /Archiver/MailInsights.aspx. The root cause is a failure to perform output encoding in the ReportScheduling.btnSaveReport_Click() function. An authenticated attacker can submit a malicious payload that is stored in the database and subsequently executed in the context of any user who views the MailInsights page. This vulnerability is tracked as CVE-2026-48539 and is resolved in version 15.13.
Affected products
- GFI Software Archiver before 15.13
Timeline
- 2026-07-23: disclosed
- 2026-07-23: advisory