CVE-2026-48530 is a stored cross-site scripting vulnerability in GFI Archiver prior to version 15.13. It arises from improper neutralization of input during web page generation in the Classification Rules configuration interface. Authenticated users can inject malicious scripts via the rule name and email criteria parameters submitted to /Archiver/CategorizationPolicyWizard.aspx. The payload is stored by the SaveAllConfigSettings() function without output encoding, leading to script execution in the browsers of users who access the Classification Rules page. This vulnerability requires authentication and user interaction (viewing the page) to trigger.

Successful exploitation allows an authenticated attacker to execute arbitrary scripts in the context of users viewing the Classification Rules page. This can lead to session hijacking, unauthorized actions, or other client-side impacts depending on the injected payload. The vulnerability does not escalate privileges or impact confidentiality, integrity, or availability directly but poses a risk to user sessions and trust.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the Classification Rules configuration page to trusted users only and consider monitoring for suspicious activity related to this interface.