What is CVE-2026-48535?
CVE-2026-48535 is a stored cross-site scripting (XSS) vulnerability in GFI Archiver versions prior to 15.13, found in the Call Home proxy server configuration. An authenticated attacker can inject arbitrary web script or HTML via the proxy server address parameter, potentially compromising user sessions. Upgrading to GFI Archiver version 15.13 or later is strongly recommended.
Azərbaycanca: CVE-2026-48535, GFI Archiver-in 15.13 versiyasından əvvəlki versiyalarında "Call Home" funksiyasında aşkarlanan saxlanılmış XSS (Stored Cross-Site Scripting) zəifliyidir. Autentifikasiya olunmuş hücumçu proxy server ünvanı parametrinə zərərli kod yeridərək istifadəçi brauzerində ixtiyari skript icra edə bilər. GFI Archiver-i 15.13 və ya daha yuxarı versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-79; shared vendor: GFI
FAQ2
What product is affected by CVE-2026-48535 and what type of vulnerability is it?
CVE-2026-48535 is a stored cross-site scripting (XSS) vulnerability found in GFI Archiver versions prior to 15.13.
How can an attacker exploit this vulnerability?
An authenticated attacker can inject arbitrary web script or HTML via the proxy server address parameter in the Call Home feature, potentially executing arbitrary script in the user's browser.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.