CVE-2026-48538

Name of the Vulnerable Software and Affected Versions GFI Archiver versions prior to 15.13

Description A stored cross-site scripting issue exists in the default import settings configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the configured folders parameter at the '/Archiver/ImportSettingsWizard.ashx' endpoint. The payload is processed by the SaveAllConfigSettings() function without proper output encoding and is subsequently executed in the browsers of users who view the Archive Assistant default import settings.

Recommendations Update GFI Archiver to version 15.13 or later.