EUVD-2026-48298
GHSA-3hvj-37hc-3qpx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible but requires authenticated low-privilege access and passive user interaction; scope is Unchanged because payload executes only within the creator's own browser session.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.
AnalysisAI
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated users to inject arbitrary web script via the scheduled report name field in the MailInsights module. The injected payload is persisted by the server-side handler ReportScheduling.btnSaveReport_Click() without output encoding and fires only in the browser of the user who created the report, making this effectively a self-XSS - significantly constraining real-world impact unless the stored report name is also rendered in other authenticated users' sessions. No public exploit code or active exploitation confirmed by CISA KEV has been identified at time of analysis.
Technical ContextAI
GFI Archiver is a commercial email archiving solution for enterprise environments (CPE: cpe:2.3:a:gfi_software:gfi_archiver:*:*:*:*:*:*:*:*). Its MailInsights component provides email analytics including a scheduled report configuration interface exposed at /Archiver/MailInsights.aspx. The root cause (CWE-79, Improper Neutralization of Input During Web Page Generation) is a failure to apply output encoding in the ASP.NET event handler ReportScheduling.btnSaveReport_Click(), which persists the report name to storage verbatim without sanitization or escaping. The raw value is subsequently rendered into the MailInsights page DOM, enabling browser-side script execution. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) reflects a network-accessible attack surface requiring low-privilege authentication and passive user interaction, with impact confined to subsequent-system context rather than the vulnerable system itself.
RemediationAI
Upgrade GFI Archiver to version 15.13 or later as documented in the vendor product releases page at https://gfi.ai/products-and-solutions/network-security-solutions/archiver/resources/documentation/product-releases. The VulnCheck advisory at https://www.vulncheck.com/advisories/gfi-archiver-stored-xss-via-mailinsights-aspx provides additional context on the vulnerable component. If immediate upgrade is not feasible, restrict access to the MailInsights scheduled report configuration endpoint (/Archiver/MailInsights.aspx) to the minimum set of users who require it, reducing the pool of accounts that could store a malicious payload. Deploying a Content-Security-Policy header via a reverse proxy or WAF to restrict inline script execution can serve as an additional compensating control, though this may interfere with legitimate GFI Archiver UI behavior and must be tested before deployment.
More in Gfi Archiver
View allStored cross-site scripting in GFI Archiver before 15.13 allows authenticated attackers to inject persistent malicious s
Stored cross-site scripting in GFI Archiver before version 15.13 enables authenticated attackers to persist arbitrary Ja
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated network-accessible users to inject persist
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privileged users to inject per
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to persistently i
Stored cross-site scripting in GFI Archiver's web administration interface allows low-privileged authenticated users to
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privilege users to inject arbi
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to inject persist
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today