Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.1
CVE-2026-48534: GFI Archiver < 15.13: Malicious Code Injection via IMAP Server Config
CVE-2026-48534 · published 3 months ago
Summary
A security flaw in GFI Archiver's IMAP Server configuration allows attackers to inject malicious code. This can happen when an authenticated user saves malicious data in the IMAP Server settings. To protect your data, update to GFI Archiver version 15.13 or later.
What to do
- Update gfi software gfi archiver to version 15.13 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| gfi software | gfi archiver | < 15.13 |
Original advisory text
GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by ImapServerWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the IMAP Server configuration page.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
5.1
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published23 Jul 2026
Updated4 Nov 2026
First seen23 Jul 2026
Track software like this
Free during beta