Stored Cross-Site Scripting in GFI Archiver by GFI Software

CVE-2026-48539

What is CVE-2026-48539?

GFI Archiver prior to version 15.13 is susceptible to a stored cross-site scripting (XSS) vulnerability within the MailInsights scheduled report configuration. This flaw enables authenticated attackers to deliver malicious web scripts or HTML through the report name parameter in the MailInsights page. When the compromised report is saved via ReportScheduling.btnSaveReport_Click(), the attacker's payload is stored without proper output encoding. This code is then executed in the browser of the user who created the report upon their subsequent access to the MailInsights page, leading to potential data compromise or further exploitation.

References