Stored XSS Vulnerability in GFI Archiver by GFI Software

CVE-2026-48535

What is CVE-2026-48535?

GFI Archiver, prior to version 15.13, is vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability resides in the configuration of the Call Home proxy server, where authenticated attackers can inject arbitrary web scripts or HTML. The malicious input can be passed through the proxy server address parameter when accessing the /Archiver/CallHomeSettingsWizard.aspx page. Once the payload is saved by the CallHomeSettingsWizard.SaveAllConfigSettings() function without appropriate output encoding, it can execute in the browsers of users who access the General Settings Additional Settings page, leading to potential exploitation.

References