CVE-2026-48535 in Archiver
Summary
by MITRE • 07/23/2026
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored by CallHomeSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings Additional Settings page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability exists within GFI Archiver version 15.13 and earlier, representing a critical stored cross-site scripting flaw that enables authenticated attackers to execute malicious code through the Call Home proxy server configuration interface. The security weakness manifests in the /Archiver/CallHomeSettingsWizard.aspx page where the proxy server address parameter fails to implement proper input validation and output encoding mechanisms. When an attacker successfully injects malicious script into this field, the application stores the payload without sanitizing it, creating a persistent threat vector that remains active until manually removed.
The technical exploitation of this vulnerability follows a specific attack pattern that aligns with CWE-79 - Cross-site Scripting flaws, where input data is not properly sanitized before being rendered back to users. The vulnerable function CallHomeSettingsWizard.SaveAllConfigSettings() demonstrates poor security practices by accepting user-supplied input without adequate filtering, allowing attackers to inject malicious HTML or JavaScript code. This stored payload becomes executable when legitimate users navigate to the General Settings Additional Settings page, which renders the unescaped configuration data in the browser context.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with potential access to sensitive user sessions and system information. The authenticated nature of the attack means that adversaries must first obtain valid credentials, but once inside the system, they can establish persistent backdoors or exfiltrate data through the compromised proxy configuration. This vulnerability creates a significant risk for organizations using GFI Archiver as it allows attackers to manipulate the call home functionality and potentially redirect system communications to malicious endpoints.
Organizations should implement immediate mitigations including upgrading to GFI Archiver version 15.13 or later where this vulnerability has been addressed, applying proper input validation controls on all user-supplied parameters, and implementing output encoding for all rendered content in web applications. The ATT&CK framework categorizes this vulnerability under T1059 - Command and Scripting Interpreter and T1566 - Phishing, as attackers can leverage the stored XSS to deliver additional payloads or redirect users to malicious sites. Network segmentation and privileged access controls should be enforced to limit the potential damage from compromised accounts, while regular security assessments should verify that all input fields properly sanitize user data to prevent similar vulnerabilities in other application components.