GFI Archiver EUVD-2026-109064

Exploitation requires an existing authenticated GFI Archiver account (PR:L) with access to create or edit a MailInsights scheduled report at /Archiver/MailInsights.aspx; the malicious script is injected via the report name parameter and persisted by ReportScheduling.btnSaveReport_Click() without output encoding. The dominant limiting factor is that the stored payload executes only in the browser of the user who created that scheduled report when they subsequently view the MailInsights page (UI:P) - this is a self-XSS with the same account as both injector and victim, so it does not directly allow one user to attack another unless combined with social engineering or account compromise. It affects GFI Archiver versions before 15.14; upgrading to 15.14 is the vendor remedy.

This is a medium-severity issue (vendor CVSS 4.0 base 5.1) that the available signals collectively place at the low end of real-world priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) shows network reach but requires existing authenticated access (PR:L) and victim interaction (UI:P), with impact confined to a subsequent system (the browser, SC:L/SI:L) and zero impact on the Archiver application itself (VC/VI/VA:N). Crucially, the description establishes this is effectively a self-XSS: the stored payload 'is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page' - the attacker and victim are the same account, which sharply undercuts the practical attack value of a stored XSS. It is NOT in CISA KEV, so exploitation status is 'no public exploit identified at time of analysis.' EPSS is NOT provided in the input, so exploitation probability cannot be quantified - this gap should be noted rather than assumed low or high. The vendor-assigned Decision label is 'this_month,' consistent with a patch-when-convenient medium issue rather than an emergency. No conflict exists between the vector and the description; both point to an authenticated, low-impact, self-targeted flaw. Overall: a genuine but low-urgency hygiene fix, not a high-risk priority.

An attacker who already holds a low-privilege authenticated GFI Archiver account creates a MailInsights scheduled report whose report name contains a malicious script payload, which is stored unencoded by ReportScheduling.btnSaveReport_Click(). When that same user later opens the MailInsights page, the script executes in their own browser session. No public exploit code is identified; because the payload executes in the creator's own browser, realistic cross-user attack value is limited.