CVE-2026-48531 is a stored cross-site scripting vulnerability affecting GFI Archiver before version 15.13. The flaw exists in the Retention Policy configuration interface, specifically in the handling of the policy name parameter submitted to /Archiver/RetentionPolicyWizard.aspx. The application fails to properly neutralize input before storing it via RetentionPolicyWizard.SaveAllConfigSettings(), leading to execution of injected scripts in the context of users who later access the Retention and Spam Policies page. This vulnerability requires authenticated access and user interaction to trigger the script execution.

Successful exploitation allows an authenticated attacker to inject and store malicious scripts that execute in the browsers of users viewing the affected page. This can lead to session hijacking, unauthorized actions performed on behalf of users, or other attacks leveraging the victim's browser context. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.1, indicating a moderate risk that requires authentication and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Retention Policy configuration pages to trusted users only and monitor for suspicious activity. Avoid using untrusted input in policy names and consider applying manual input validation or output encoding as a temporary mitigation.