CVE-2026-48534 in Archiver
Summary
by MITRE • 07/23/2026
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by ImapServerWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the IMAP Server configuration page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability represents a critical stored cross-site scripting flaw in GFI Archiver versions prior to 15.13, specifically within the IMAP Server configuration module. The issue manifests through the /Archiver/ImapServerWizard.aspx page where attackers with valid authentication credentials can manipulate the server URL parameter to inject malicious scripts. This vulnerability falls under CWE-079 - Improper Neutralization of Input During Web Page Generation, which is a fundamental web application security weakness that allows attackers to execute arbitrary code in victim browsers. The flaw occurs because the application fails to properly sanitize or encode user input before storing it in the configuration settings, creating a persistent vector for malicious payloads.
The technical execution of this vulnerability requires an authenticated attacker who can navigate to the IMAP Server configuration page and manipulate the server URL parameter through the web interface. When the vulnerable code processes this input, it calls ImapServerWizard.SaveAllConfigSettings() method which stores the unvalidated input without proper output encoding. This stored data is subsequently retrieved and rendered on the IMAP Server configuration page without appropriate HTML escaping or context-aware encoding. The impact extends beyond simple script execution as this vulnerability can be leveraged for session hijacking, credential theft, and browser-based attacks that persist across user sessions.
The operational implications of this vulnerability are severe as it allows attackers to establish persistent footholds within the email archiving environment. Once an attacker injects malicious code through the server URL parameter, any user who views the IMAP Server configuration page becomes a victim of the stored XSS attack. This creates a vector for advanced persistent threats where attackers can monitor user activities, steal session cookies, redirect users to malicious sites, or even deploy additional malware through browser-based exploits. The attack surface is particularly concerning in enterprise environments where email archiving systems are critical infrastructure components that require high levels of security and trust.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1566.002 - Phishing: Spearphishing Attachment, as it enables attackers to craft convincing phishing campaigns targeting email administrators. The vulnerability also maps to ATT&CK technique T1059.007 - Command and Scripting Interpreter: JavaScript, since the exploitation relies on JavaScript execution within victim browsers. Organizations should implement immediate mitigations including applying the vendor-provided patch for GFI Archiver version 15.13 or later, implementing input validation and output encoding controls in the application layer, and conducting security assessments to identify other potential stored XSS vulnerabilities. Additionally, network segmentation and privileged access controls should be enforced to limit the potential impact of successful exploitation attempts.