EUVD-2026-48297
GHSA-746j-5264-mj4g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible stored XSS; PR:L for required authentication, UI:R for victim's passive page view, S:C for cross-user browser impact, C:L/I:L for session and content compromise.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configuration that allows authenticated attackers to inject arbitrary web script or HTML via the configured folders parameter to /Archiver/ImportSettingsWizard.ashx. The injected payload is stored by ImportSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Archive Assistant default import settings.
AnalysisAI
Stored cross-site scripting in GFI Archiver before version 15.13 enables authenticated attackers to persist arbitrary JavaScript in the Archive Assistant default import settings by injecting through the configured folders parameter at /Archiver/ImportSettingsWizard.ashx. The payload survives server-side because SaveAllConfigSettings() writes it to storage without output encoding, then executes in the browser of any subsequent user who views the import settings page - including potentially higher-privileged administrators. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects the authenticated entry requirement and the downstream scope change to other users' browser sessions.
Technical ContextAI
GFI Archiver is an enterprise email archiving solution by GFI Software. The vulnerability resides in the web-based Archive Assistant component, specifically the ImportSettingsWizard.ashx HTTP handler. The server-side method SaveAllConfigSettings() accepts the configured folders parameter from HTTP input and writes it directly to persistent configuration storage without applying output encoding or input sanitization, a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) stored XSS pattern. When the stored settings are later retrieved and rendered by the browser, the injected payload executes in the victim's DOM context. The CPE cpe:2.3:a:gfi_software:gfi_archiver:*:*:*:*:*:*:*:* indicates all tracked versions up to the fix are affected. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) confirms the attack surface is the network-accessible web interface with no special attack requirements beyond low-privilege authentication.
RemediationAI
Upgrade GFI Archiver to version 15.13 or later, the first release that is not subject to this vulnerability per the disclosure. Confirm the exact build and changelog entry via GFI Software's official release notes at https://gfi.ai/products-and-solutions/network-security-solutions/archiver/resources/documentation/product-releases. If immediate patching is not feasible, restrict write access to the Archive Assistant import settings (the /Archiver/ImportSettingsWizard.ashx endpoint) to the smallest possible set of trusted accounts - this reduces the attacker population capable of injecting a payload, though it does not eliminate the stored XSS risk for those accounts. Additionally, audit existing import settings configurations for unexpected or obfuscated values in the configured folders field, which could indicate prior exploitation. Implementing a strict Content Security Policy header on the GFI Archiver web interface, if the application supports it, would limit the impact of any injected scripts by blocking external resource loading and inline execution.
More in Gfi Archiver
View allStored cross-site scripting in GFI Archiver before 15.13 allows authenticated attackers to inject persistent malicious s
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated users to inject arbitrary web scri
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated network-accessible users to inject persist
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privileged users to inject per
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to persistently i
Stored cross-site scripting in GFI Archiver's web administration interface allows low-privileged authenticated users to
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privilege users to inject arbi
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to inject persist
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today