CVE-2026-48532

Name of the Vulnerable Software and Affected Versions GFI Archiver versions prior to 15.13

Description A stored cross-site scripting issue exists in the File History Retention Policy configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the policy name parameter at the '/Archiver/FAARetentionPolicyWizard.aspx' endpoint. The payload is processed by the SaveAllConfigSettings() function without proper output encoding and is subsequently executed in the browsers of users who access the File History Retention Policies page.

Recommendations Update GFI Archiver to version 15.13 or later.