CVE-2026-112333: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GFI Software GFI Archiver

CVE-2026-112333 is a stored cross-site scripting vulnerability in GFI Archiver prior to version 15.14. The flaw exists in the MailInsights scheduled report configuration feature, where the report name parameter is not properly neutralized before being stored by the ReportScheduling.btnSaveReport_Click() method. This allows authenticated attackers to inject arbitrary HTML or script code that executes in the context of the victim's browser when they view the affected MailInsights page. The vulnerability requires authentication and user interaction to trigger.

An authenticated attacker can inject malicious scripts that execute in the context of the victim's browser, potentially leading to session hijacking, unauthorized actions, or data disclosure within the scope of the affected user. The impact is limited to users who create or view scheduled reports in MailInsights. There is no indication of remote unauthenticated exploitation or system-level compromise.

A fixed version 15.14 or later should be applied to remediate this vulnerability. Since no explicit patch link or vendor advisory was provided, users should verify with GFI Software for the official update. Until patched, avoid creating or viewing scheduled reports with untrusted input in the report name parameter. Employ input validation and output encoding as a temporary mitigation if possible.