CVE-2026-48537

Name of the Vulnerable Software and Affected Versions GFI Archiver versions prior to 15.13

Description A stored cross-site scripting issue exists in the File Archive Assistant configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the excluded extensions parameter at the '/Archiver/FileArchiveAssistantWizard.aspx' endpoint. The payload is processed by the FileArchiveAssistantWizard.btnSave Click() function without proper output encoding and is subsequently executed in the browsers of users who access the File Archive Assistant settings page.

Recommendations Update GFI Archiver to version 15.13 or later. As a temporary mitigation, restrict access to the '/Archiver/FileArchiveAssistantWizard.aspx' endpoint or avoid modifying the excluded extensions parameter.