What is CVE-2026-48532?
GFI Archiver before version 15.13 contains a stored XSS vulnerability in the File History Retention Policy configuration. An authenticated attacker can inject arbitrary script via the policy name parameter in /Archiver/FAARetentionPolicyWizard.aspx. Upgrading to the latest version is recommended.
Azərbaycanca: GFI Archiver 15.13-dən əvvəlki versiyalarda saxlanılmış XSS zəifliyi aşkarlanıb. Bu, autentifikasiya olunmuş hücumçuya Fayl Tarixçəsinin Saxlanma Siyasəti konfiqurasiyasındakı siyasət adı parametri vasitəsilə zərərli skript yeritməyə imkan verir. Məhsulu ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-79; shared vendor: GFI
FAQ2
Is authentication required for an attacker to exploit CVE-2026-48532?
Yes, this stored XSS vulnerability can only be exploited by an authenticated attacker.
Which parameter in GFI Archiver causes this stored XSS vulnerability?
The vulnerability occurs via the policy name parameter in the File History Retention Policy configuration.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.