CVE-2026-48530

Name of the Vulnerable Software and Affected Versions GFI Archiver versions prior to 15.13

Description A stored cross-site scripting issue exists in the Classification Rules configuration. Authenticated attackers can inject arbitrary web script or HTML through the /Archiver/CategorizationPolicyWizard.aspx endpoint using the rule name and email criteria parameters. The payload is stored by the SaveAllConfigSettings() function without proper output encoding and is executed in the browsers of users who view the Classification Rules page.

Recommendations Update GFI Archiver to version 15.13 or later.