CVE-2026-48536 in Archiver
Summary
by MITRE • 07/23/2026
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload is stored by GeneralSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability represents a critical stored cross-site scripting flaw in GFI Archiver versions prior to 15.13 that stems from inadequate input validation and output encoding mechanisms within the web application's configuration interface. The issue specifically manifests in the General Settings SMTP configuration section where authenticated users can manipulate the SMTP server address parameter through the /Archiver/GeneralSettingsWizard.aspx page. When an attacker successfully injects malicious script code into this field, the application stores the payload without proper sanitization or encoding, creating a persistent security risk that affects all subsequent users who access the General Settings page.
The technical exploitation of this vulnerability follows a well-established XSS attack pattern where the malicious input is processed through the GeneralSettingsWizard.SaveAllConfigSettings() method without appropriate security measures to prevent script execution. This method fails to implement proper output encoding or validation controls that would normally be expected in secure web application development practices. The stored nature of this vulnerability means that once an attacker successfully injects malicious code, it remains persistent within the application's configuration storage and executes automatically whenever legitimate users view the affected page, making it particularly dangerous for environments where multiple administrators may access the system.
The operational impact of this vulnerability extends beyond simple script execution as it provides attackers with potential access to sensitive administrative functions and user data. Through carefully crafted payloads, attackers could potentially steal session cookies, redirect users to malicious sites, or execute additional attacks against the compromised system. The authenticated nature of the attack requires an attacker to first obtain valid credentials, but once achieved, the vulnerability creates a persistent backdoor that can be exploited repeatedly without further authentication requirements. This risk is compounded by the fact that many organizations may not immediately notice the compromise due to the indirect nature of the attack vector.
Organizations affected by this vulnerability should prioritize immediate remediation through patching to GFI Archiver version 15.13 or later, which includes proper input validation and output encoding controls. Security teams should implement network monitoring to detect potential exploitation attempts and review access logs for any unusual activity related to the General Settings configuration page. The vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') and represents a classic example of how insufficient input sanitization can create persistent security weaknesses in web applications. From an ATT&CK framework perspective, this vulnerability maps to T1566.001: Phishing: Spearphishing Attachment and T1071.004: Application Layer Protocol: DNS, as attackers could use the XSS to redirect users or harvest credentials through malicious redirects and session hijacking techniques. Additionally, organizations should review their privileged access controls and implement principle of least privilege enforcement to limit potential damage from successful exploitation attempts.