EUVD-2026-48294
GHSA-pwg9-3f2x-q22x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-privilege injection with scope change to victim browsers (S:C/UI:R); limited C:L/I:L reflecting session theft risk, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored by CallHomeSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings Additional Settings page.
AnalysisAI
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated attackers to inject persistent malicious scripts via the proxy server address field in the Call Home configuration wizard. The CallHomeSettingsWizard.SaveAllConfigSettings() method stores the attacker-supplied input without output encoding, and the payload subsequently executes in the browsers of any user who visits the General Settings Additional Settings page - including administrators, whose sessions could be harvested. No public exploit or CISA KEV listing is identified at time of analysis, but the stored nature of the XSS elevates impact beyond a reflected variant by enabling broad victim targeting post-injection.
Technical ContextAI
GFI Archiver is an enterprise email archiving product by GFI Software. The vulnerability resides in the ASP.NET-based web administration interface, specifically the endpoint /Archiver/CallHomeSettingsWizard.aspx, which manages Call Home telemetry proxy settings. The server-side method CallHomeSettingsWizard.SaveAllConfigSettings() accepts and persists the proxy server address parameter without applying HTML output encoding before storage. When the stored value is later rendered in the General Settings Additional Settings view, the browser interprets it as executable script. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class - a failure to enforce output encoding at the persistence or rendering layer. The CPE string cpe:2.3:a:gfi_software:gfi_archiver:*:*:*:*:*:*:*:* scopes the affected product to all GFI Archiver versions below 15.13.
RemediationAI
Upgrade GFI Archiver to version 15.13 or later using the release artifacts documented at https://gfi.ai/products-and-solutions/network-security-solutions/archiver/resources/documentation/product-releases. If immediate patching is not feasible, restrict network-level access to the administration interface (specifically /Archiver/CallHomeSettingsWizard.aspx and the General Settings pages) to a dedicated management VLAN or trusted IP ranges - this reduces the pool of accounts that could inject the payload but does not remediate any payload already stored. Additionally, auditing the current proxy server address value in CallHome settings for unexpected content can detect prior injection. Note that access restriction does not address payloads that may have already been stored before the control is applied; a full remediation requires patching and clearing any malicious configuration values.
More in Gfi Archiver
View allStored cross-site scripting in GFI Archiver before version 15.13 allows authenticated users to inject arbitrary web scri
Stored cross-site scripting in GFI Archiver before version 15.13 enables authenticated attackers to persist arbitrary Ja
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated network-accessible users to inject persist
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privileged users to inject per
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to persistently i
Stored cross-site scripting in GFI Archiver's web administration interface allows low-privileged authenticated users to
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privilege users to inject arbi
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to inject persist
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today