CVE-2026-48534

Name of the Vulnerable Software and Affected Versions GFI Archiver versions prior to 15.13

Description A stored cross-site scripting issue exists in the IMAP Server configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the server URL parameter at the '/Archiver/ImapServerWizard.aspx' endpoint. The payload is processed by the ImapServerWizard.SaveAllConfigSettings() function without proper output encoding, causing the script to execute in the browsers of users who access the IMAP Server configuration page.

Recommendations Update GFI Archiver to version 15.13 or later.