CVE-2026-48537 Details
Description
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers to inject arbitrary web script or HTML via the excluded extensions parameter to /Archiver/FileArchiveAssistantWizard.aspx. The injected payload is stored by FileArchiveAssistantWizard.btnSave_Click() without output encoding and is executed in the browsers of users who subsequently view the File Archive Assistant settings page.
A stored cross-site scripting vulnerability has been identified in GFI Archiver versions prior to 15.13. This vulnerability resides in the File Archive Assistant configuration, where authenticated attackers can inject arbitrary web scripts or HTML. The injection occurs through the excluded extensions parameter on the FileArchiveAssistantWizard.aspx page. The injected payload is saved without proper output encoding and is executed in the browsers of users who later access the File Archive Assistant settings page.
Users can upgrade to GFI Archiver version 15.13 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 23, 2026CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GFI Archiver | < 15.13 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | New CVE Received | [email protected] |
| Jul 23, 2026 | CVE Modified | CISA-ADP |