CVE-2026-48537 in Archiver
Summary
by MITRE • 07/23/2026
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers to inject arbitrary web script or HTML via the excluded extensions parameter to /Archiver/FileArchiveAssistantWizard.aspx. The injected payload is stored by FileArchiveAssistantWizard.btnSave_Click() without output encoding and is executed in the browsers of users who subsequently view the File Archive Assistant settings page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability represents a critical stored cross-site scripting flaw in GFI Archiver software versions prior to 15.13, specifically affecting the File Archive Assistant configuration component. The issue stems from inadequate input validation and output encoding within the web application's security controls, creating an avenue for authenticated attackers to inject malicious code into the system. The vulnerability manifests through the excluded extensions parameter field in the /Archiver/FileArchiveAssistantWizard.aspx page, where user-supplied input is processed without proper sanitization or encoding mechanisms.
The technical implementation of this flaw occurs within the FileArchiveAssistantWizard.btnSave_Click() method which handles form submission processing. This method fails to implement proper output encoding before storing user-provided data, allowing malicious payloads to be permanently embedded within the application's configuration state. When legitimate users subsequently navigate to the File Archive Assistant settings page, their browsers execute the stored malicious scripts within the context of their authenticated sessions, potentially enabling a range of attack vectors including credential theft, session hijacking, or redirection to malicious sites.
From an operational impact perspective, this vulnerability compromises the integrity and confidentiality of the affected system by allowing attackers with valid credentials to escalate their privileges and compromise user sessions. The stored nature of the XSS vulnerability means that the malicious code persists even after the initial injection, making it particularly dangerous as it can affect multiple users over extended periods without requiring repeated exploitation attempts. This vulnerability also violates fundamental security principles outlined in CWE-79 which addresses cross-site scripting flaws, and aligns with ATT&CK technique T1566.002 for social engineering through malicious content injection.
The attack scenario involves an authenticated user with sufficient privileges to access the File Archive Assistant configuration interface. The attacker crafts a malicious payload targeting the excluded extensions parameter field, submits it through the web form, and waits for other users to view the settings page. This creates a persistent threat vector that can be exploited by attackers who have gained any level of legitimate access to the system. Organizations should immediately implement mitigations including input validation, output encoding, and regular security updates to address this vulnerability while also considering network-based protections such as web application firewalls and content security policies to prevent exploitation attempts.
This vulnerability demonstrates the critical importance of proper input sanitization and output encoding in web applications, particularly within administrative interfaces where privileged users can inadvertently create persistent attack vectors. The flaw represents a failure in the principle of least privilege and proper security controls implementation, as it allows authenticated access to enable malicious code execution without proper validation of user-supplied content. Organizations should conduct comprehensive security assessments to identify similar vulnerabilities across their application portfolios and implement robust security measures including regular patch management, input validation frameworks, and security monitoring systems to detect and prevent such exploitation attempts.