EUVD-2026-48296
GHSA-4448-cm9w-pfq8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible stored XSS planted by authenticated low-privilege user; victim must view page (UI:R); payload executes in victim browser context causing scope change (S:C) with limited session-level C/I impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers to inject arbitrary web script or HTML via the excluded extensions parameter to /Archiver/FileArchiveAssistantWizard.aspx. The injected payload is stored by FileArchiveAssistantWizard.btnSave_Click() without output encoding and is executed in the browsers of users who subsequently view the File Archive Assistant settings page.
AnalysisAI
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated network-accessible users to inject persistent JavaScript into the File Archive Assistant configuration page via the excluded extensions parameter. The payload is stored server-side by FileArchiveAssistantWizard.btnSave_Click() without output encoding and executes in the browser of any user who subsequently views the File Archive Assistant settings page - typically an administrator. No public exploit identified at time of analysis and no CISA KEV listing; real-world impact is limited to browser-session-level attacks against users who access the specific settings page.
Technical ContextAI
GFI Archiver is an enterprise email and file archiving solution by GFI Software (CPE: cpe:2.3:a:gfi_software:gfi_archiver:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored/persistent variant. The excluded extensions field submitted via POST to /Archiver/FileArchiveAssistantWizard.aspx is written to persistent storage by the server-side event handler btnSave_Click() without applying HTML output encoding or input sanitization. When the File Archive Assistant settings page is subsequently rendered for any user, the unencoded payload is injected into the HTML DOM context and executed by the victim's browser. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) correctly models this as a network-reachable, low-complexity attack where the vulnerable system itself incurs no direct data exposure, but a subsequent user's browser session (subsequent-system) sustains limited confidentiality and integrity impact.
RemediationAI
Upgrade GFI Archiver to version 15.13 or later, which is the vendor-confirmed patched release per product documentation at https://gfi.ai/products-and-solutions/network-security-solutions/archiver/resources/documentation/product-releases. If immediate patching is not feasible, restrict access to /Archiver/FileArchiveAssistantWizard.aspx at the network or application layer to the minimum set of trusted administrators, eliminating the low-privileged attacker precondition for planting the payload - note this may disrupt legitimate configuration workflows for non-admin users. As a secondary defense-in-depth measure, a web application firewall rule blocking script-tag or event-handler patterns in the excluded extensions parameter can reduce risk, though WAF-level XSS filtering is subject to evasion and should not be treated as a reliable standalone control. Advise all administrative users to avoid accessing the File Archive Assistant settings page until patching is complete.
More in Gfi Archiver
View allStored cross-site scripting in GFI Archiver before 15.13 allows authenticated attackers to inject persistent malicious s
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated users to inject arbitrary web scri
Stored cross-site scripting in GFI Archiver before version 15.13 enables authenticated attackers to persist arbitrary Ja
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privileged users to inject per
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to persistently i
Stored cross-site scripting in GFI Archiver's web administration interface allows low-privileged authenticated users to
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privilege users to inject arbi
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to inject persist
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today