EUVD-2026-48293
GHSA-pqjc-327p-9x24
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS requires authenticated low-privilege access (PR:L), passive victim interaction (UI:R), triggers scope change into victim browser (S:C) with low confidentiality and integrity impact; no availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by ImapServerWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the IMAP Server configuration page.
AnalysisAI
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to persistently inject arbitrary JavaScript or HTML via the server URL parameter on the IMAP Server configuration wizard at /Archiver/ImapServerWizard.aspx. The payload is written to persistent storage by ImapServerWizard.SaveAllConfigSettings() without output encoding, and executes in the browser of any user - typically an administrator - who subsequently navigates to the IMAP Server configuration page. No public exploit identified at time of analysis and this vulnerability is not listed in CISA KEV.
Technical ContextAI
GFI Archiver (cpe:2.3:a:gfi_software:gfi_archiver:*:*:*:*:*:*:*:*) is a commercial email archiving solution with a web-based management interface built on ASP.NET WebForms. The IMAP Server configuration wizard (ImapServerWizard.aspx) accepts a server URL field that is persisted by the server-side method SaveAllConfigSettings() and later rendered back to the browser without HTML encoding or output sanitization. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) stored variant: user-supplied data enters a persistence layer at one point in time and is unsafely rendered at a separate point in time, decoupling injection from execution. The stored nature means the payload survives across sessions and affects multiple victims, distinguishing it from reflected XSS in terms of operational impact.
RemediationAI
Upgrade GFI Archiver to version 15.13 or later per the vendor release notes at https://gfi.ai/products-and-solutions/network-security-solutions/archiver/resources/documentation/product-releases. If immediate patching is not feasible, restrict access to the IMAP Server configuration wizard endpoint (/Archiver/ImapServerWizard.aspx) at the network or application layer to the smallest set of trusted administrator accounts; this reduces the pool of users who could both inject a payload and trigger execution. Additionally, review IMAP server URL values already stored in configuration for unexpected script tags or encoded JavaScript as part of an indicator-of-compromise sweep. Note that restricting endpoint access is a compensating control only - it does not remediate the underlying lack of output encoding and should not substitute for patching.
More in Gfi Archiver
View allStored cross-site scripting in GFI Archiver before 15.13 allows authenticated attackers to inject persistent malicious s
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated users to inject arbitrary web scri
Stored cross-site scripting in GFI Archiver before version 15.13 enables authenticated attackers to persist arbitrary Ja
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated network-accessible users to inject persist
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privileged users to inject per
Stored cross-site scripting in GFI Archiver's web administration interface allows low-privileged authenticated users to
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privilege users to inject arbi
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to inject persist
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today