Stored Cross-Site Scripting Vulnerability in GFI Archiver

CVE-2026-48537

What is CVE-2026-48537?

GFI Archiver prior to version 15.13 contains a vulnerability that permits authenticated attackers to execute arbitrary web scripts or HTML. This occurs through the excluded extensions parameter in the configuration of the File Archive Assistant. When an attacker crafts a malicious payload, it gets stored by the application without proper output encoding. This stored data is later executed in the browsers of users who access the File Archive Assistant settings page, potentially leading to unauthorized actions and data exposure.

References