Stored Cross-Site Scripting in GFI Archiver
CVE-2026-112333

5.1MEDIUM

Key Information:

Vendor

Gfi Software

Status
Gfi Archiver
Vendor
CVE Published:
23 October 2026

What is CVE-2026-112333?

GFI Archiver prior to version 15.14 is susceptible to a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration. This issue allows authenticated users to inject arbitrary web scripts or HTML through the report name parameter. The malicious payload is stored and executed when the user views their scheduled report on the MailInsights page, potentially compromising their session and exposing sensitive information.

Affected Version(s)

GFI Archiver 0 < 15.14

References

https://gfi.ai/products-and-solutions/network-security-so...
patchrelease-notes
https://www.vulncheck.com/advisories/gfi-archiver-stored-...

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Williams from Pellera Technologies
.