CVE-2026-48535

Name of the Vulnerable Software and Affected Versions GFI Archiver versions prior to 15.13

Description A stored cross-site scripting issue exists in the Call Home proxy server configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the proxy server address parameter at the '/Archiver/CallHomeSettingsWizard.aspx' endpoint. The payload is processed by the SaveAllConfigSettings() function without proper output encoding and is subsequently executed in the browsers of users who access the General Settings Additional Settings page.

Recommendations Update GFI Archiver to version 15.13 or later.