CVE-2026-48535: fallo de gravedad media en GFI Archiver
GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.1epss 0.2%
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored by CallHomeSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings Additional Settings page.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Productos afectados
GFI Software · GFI ArchiverCVEs relacionadas — GFI Archiver
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-48539MEDIUMGFI Archiver < 15.14 Stored XSS via MailInsights.aspxEPSS 0.2%CVE-2026-48538MEDIUMGFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashxEPSS 0.2%CVE-2026-48537MEDIUMGFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspxEPSS 0.2%CVE-2026-48536MEDIUMGFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspxEPSS 0.2%CVE-2026-48534MEDIUMGFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspxEPSS 0.2%CVE-2026-48532MEDIUMGFI Archiver < 15.13 Stored XSS via FAARetentionPolicyWizard.aspxEPSS 0.2%