CVE-2026-48532 is a stored cross-site scripting vulnerability in GFI Archiver before version 15.13. It arises from improper neutralization of input during web page generation in the File History Retention Policy configuration. Specifically, the policy name parameter passed to /Archiver/FAARetentionPolicyWizard.aspx is not properly encoded before storage by RetentionPolicyWizard.SaveAllConfigSettings(), allowing an authenticated attacker to inject malicious scripts. These scripts execute in the context of users who subsequently access the File History Retention Policies page, potentially leading to session hijacking or other script-based attacks. The vulnerability requires authentication and user interaction to exploit.

Successful exploitation allows an authenticated attacker to inject and store malicious scripts that execute in the browsers of users viewing the File History Retention Policies page. This can lead to unauthorized actions performed on behalf of users, theft of session tokens, or other malicious activities within the affected application context. The vulnerability does not require elevated privileges beyond authentication and has no known exploits in the wild as of the published date.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the File History Retention Policy configuration page to trusted users only and monitor for suspicious activity. Avoid using untrusted input in the policy name parameter. Follow vendor updates closely for an official fix.