CVE-2026-48536

Name of the Vulnerable Software and Affected Versions GFI Archiver versions prior to 15.13

Description A stored cross-site scripting issue exists in the General Settings SMTP configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the SMTP server address parameter at the '/Archiver/GeneralSettingsWizard.aspx' endpoint. The payload is processed by the SaveAllConfigSettings() function without proper output encoding, causing the script to execute in the browsers of users who access the General Settings page.

Recommendations Update GFI Archiver to version 15.13 or later.