EUVD-2026-48295
GHSA-3hhj-3rqm-6fp9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS requires low-privilege write access (PR:L) and victim browser rendering (UI:R); scope changes to victim session context (S:C) with low C/I impact; no availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload is stored by GeneralSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings page.
AnalysisAI
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privileged users to inject persistent JavaScript into the SMTP server address field of the General Settings wizard, which subsequently executes in the browsers of any user who views that settings page. The flaw resides in the server-side method GeneralSettingsWizard.SaveAllConfigSettings(), which persists the SMTP address parameter without output encoding, enabling payload storage and deferred execution. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low attack complexity and the likelihood that administrators frequently access General Settings elevates practical risk beyond the moderate CVSS 4.0 score of 5.1.
Technical ContextAI
GFI Archiver is an enterprise email archiving product from GFI Software, identified by CPE cpe:2.3:a:gfi_software:gfi_archiver:*:*:*:*:*:*:*:*. The application exposes an ASP.NET web interface, and the General Settings wizard at /Archiver/GeneralSettingsWizard.aspx accepts SMTP relay configuration including a server address field. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant: the SaveAllConfigSettings() method writes user-supplied SMTP address input to persistent storage without sanitization or context-aware output encoding, and the value is later rendered directly into the HTML response when the settings page is loaded. This is a classic stored XSS pattern in a configuration management endpoint, where the injection point requires low privilege to write but impacts higher-privilege users who subsequently render the stored value.
RemediationAI
Upgrade GFI Archiver to version 15.13 or later, which resolves the missing output encoding in GeneralSettingsWizard.SaveAllConfigSettings(). Upgrade guidance and release notes are available at https://gfi.ai/products-and-solutions/network-security-solutions/archiver/resources/documentation/product-releases. If immediate patching is not feasible, restrict access to /Archiver/GeneralSettingsWizard.aspx at the network or application layer to only trusted administrator IP ranges, reducing the pool of accounts that can write to the SMTP address field - this limits exposure but does not eliminate the underlying flaw if any authorized admin account is compromised. Additionally, audit stored SMTP configuration values for unexpected script-like content as an indicator of prior exploitation. Note that blocking access to the settings page entirely would prevent SMTP reconfiguration, so evaluate operational trade-offs.
More in Gfi Archiver
View allStored cross-site scripting in GFI Archiver before 15.13 allows authenticated attackers to inject persistent malicious s
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated users to inject arbitrary web scri
Stored cross-site scripting in GFI Archiver before version 15.13 enables authenticated attackers to persist arbitrary Ja
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated network-accessible users to inject persist
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to persistently i
Stored cross-site scripting in GFI Archiver's web administration interface allows low-privileged authenticated users to
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privilege users to inject arbi
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to inject persist
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today