CVE-2026-48534 is a stored cross-site scripting vulnerability affecting GFI Archiver prior to version 15.13. The vulnerability exists in the IMAP Server configuration functionality, specifically in the handling of the server URL parameter on the /Archiver/ImapServerWizard.aspx page. Authenticated attackers can inject malicious scripts that are stored by the ImapServerWizard.SaveAllConfigSettings() method without proper output encoding. When other users access the IMAP Server configuration page, the malicious script executes in their browsers, potentially leading to session hijacking or other script-based attacks. The vulnerability requires authentication and user interaction to exploit and has no known exploits in the wild as of the publication date.

Successful exploitation allows an authenticated attacker to inject and store malicious scripts that execute in the browsers of users who view the affected IMAP Server configuration page. This can lead to unauthorized actions performed in the context of the victim's session, such as theft of session tokens or other sensitive information. The vulnerability does not require elevated privileges beyond authentication and does not affect confidentiality, integrity, or availability directly but poses a risk of client-side script execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the IMAP Server configuration page to trusted users only and consider monitoring for suspicious activity. Avoid clicking on untrusted links or parameters related to the IMAP Server configuration. Follow vendor updates for patches or official mitigations.