CVE-2026-48531 is a stored cross-site scripting vulnerability in GFI Archiver prior to version 15.13. The issue arises because the RetentionPolicyWizard.SaveAllConfigSettings() function stores user-supplied input from the policy name parameter without output encoding. This allows authenticated attackers to inject malicious scripts or HTML that execute in the context of users who later access the Retention and Spam Policies page, potentially leading to script execution in their browsers. The vulnerability requires authentication and user interaction to exploit and is rated medium severity with a CVSS 4.0 score of 5.1.

An authenticated attacker can inject and store malicious scripts via the policy name parameter, which are then executed in the browsers of users who view the affected page. This could lead to unauthorized actions performed in the context of the victim's session, such as theft of session tokens or other malicious activities limited to the scope of the XSS vulnerability. There is no indication of privilege escalation or remote code execution from the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor vendor communications for updates. Until a patch is available, restrict access to the Retention Policy configuration page to trusted users only and consider applying web application firewall (WAF) rules to detect and block suspicious input patterns targeting the policy name parameter.