EUVD-2026-48290
GHSA-7pjr-q4f8-86mp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects required authenticated access to inject; UI:R and S:C capture stored payload detonating in other users' browser sessions with low C/I impact; no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to inject arbitrary web script or HTML via the rule name and email criteria parameters to /Archiver/CategorizationPolicyWizard.aspx. The injected payload is stored by CategorizationPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Classification Rules page.
AnalysisAI
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to inject persistent malicious scripts via the Classification Rules configuration, specifically the rule name and email criteria fields in CategorizationPolicyWizard.aspx. The injected payload is written to the backend by SaveAllConfigSettings() without any output encoding, causing it to execute in the browsers of every subsequent user who views the Classification Rules page - including administrators. No public exploit code has been identified and no active exploitation is confirmed at time of analysis.
Technical ContextAI
GFI Archiver is an enterprise email archiving platform developed by GFI Software, identified by CPE cpe:2.3:a:gfi_software:gfi_archiver:*:*:*:*:*:*:*:*. The vulnerable component is an ASP.NET web wizard at /Archiver/CategorizationPolicyWizard.aspx responsible for managing email categorization (Classification Rules) policies. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant: the server-side method CategorizationPolicyWizard.SaveAllConfigSettings() persists attacker-controlled input from the rule name and email criteria parameters directly to storage without applying HTML output encoding or Content Security Policy enforcement. When the stored data is later rendered to other users' browsers, the injected script executes in their authenticated session context, representing a classic stored XSS pattern where the injection point and the execution point are decoupled across different user sessions.
RemediationAI
The primary remediation is to upgrade GFI Archiver to version 15.13 or later, which resolves the missing output encoding in CategorizationPolicyWizard.SaveAllConfigSettings(); the vendor's release documentation is at https://gfi.ai/products-and-solutions/network-security-solutions/archiver/resources/documentation/product-releases and the VulnCheck advisory is at https://www.vulncheck.com/advisories/gfi-archiver-stored-xss-via-categorizationpolicywizard-aspx. If immediate patching is not feasible, restrict access to /Archiver/CategorizationPolicyWizard.aspx to the smallest possible set of trusted administrators via network-layer controls or application firewall rules - this reduces the injection surface but does not eliminate stored payloads already present. Additionally, audit existing Classification Rules for unexpected or obfuscated content in rule name and email criteria fields, and purge any suspicious entries before allowing administrative users to view the configuration page. Note that access restriction reduces who can inject but does not protect against payloads already stored prior to the control being applied.
More in Gfi Archiver
View allStored cross-site scripting in GFI Archiver before 15.13 allows authenticated attackers to inject persistent malicious s
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated users to inject arbitrary web scri
Stored cross-site scripting in GFI Archiver before version 15.13 enables authenticated attackers to persist arbitrary Ja
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated network-accessible users to inject persist
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privileged users to inject per
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to persistently i
Stored cross-site scripting in GFI Archiver's web administration interface allows low-privileged authenticated users to
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privilege users to inject arbi
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today