EUVD-2026-48291
GHSA-224c-7qmf-qhq6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible stored XSS requiring low-privilege auth to plant payload and victim interaction to trigger; scope change applies as script crosses into the victim's browser session context.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/RetentionPolicyWizard.aspx. The injected payload is stored by RetentionPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Retention and Spam Policies page.
AnalysisAI
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privilege users to inject arbitrary script via the Retention Policy name field at /Archiver/RetentionPolicyWizard.aspx, with the payload persisting through SaveAllConfigSettings() and executing against any user who subsequently views the Retention and Spam Policies page. The CVSS 4.0 score of 5.1 reflects network-accessible reach offset by required authentication and passive victim interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, suggesting this has not yet seen active widespread exploitation.
Technical ContextAI
GFI Archiver is an enterprise email archiving platform by GFI Software. The vulnerable component is the web-based Retention Policy configuration wizard at /Archiver/RetentionPolicyWizard.aspx, a server-side ASP.NET endpoint. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the failure of the backend method RetentionPolicyWizard.SaveAllConfigSettings() to apply output encoding before persisting the policy name value to the data store. Because the stored value is later reflected directly into the Retention and Spam Policies page without HTML encoding, any script injected into the name field executes in the browser of every user who loads that page. The CPE cpe:2.3:a:gfi_software:gfi_archiver:*:*:*:*:*:*:*:* covers all versions prior to 15.13 across all platforms.
RemediationAI
Upgrade GFI Archiver to version 15.13 or later, which resolves the stored XSS per the vendor release notes at https://gfi.ai/products-and-solutions/network-security-solutions/archiver/resources/documentation/product-releases. Full technical details and vendor confirmation are available in the VulnCheck advisory at https://www.vulncheck.com/advisories/gfi-archiver-stored-xss-via-retentionpolicywizard-aspx. Where immediate patching is not feasible, restrict access to the RetentionPolicyWizard.aspx endpoint and the Retention Policy configuration to the smallest set of trusted administrators - this eliminates the low-privilege attack surface at the cost of reducing self-service policy management. Deploying a web application firewall rule to detect and block unsanitized script tags in the policy name field can provide additional defense-in-depth, though WAF rules for stored XSS are bypassable and should not substitute for patching. Implementing a strict Content Security Policy header via a reverse proxy may limit script execution scope but risks breaking legitimate application UI functionality.
More in Gfi Archiver
View allStored cross-site scripting in GFI Archiver before 15.13 allows authenticated attackers to inject persistent malicious s
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated users to inject arbitrary web scri
Stored cross-site scripting in GFI Archiver before version 15.13 enables authenticated attackers to persist arbitrary Ja
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated network-accessible users to inject persist
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privileged users to inject per
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to persistently i
Stored cross-site scripting in GFI Archiver's web administration interface allows low-privileged authenticated users to
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to inject persist
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today