CVE-2026-48535 is a stored cross-site scripting vulnerability affecting GFI Archiver before version 15.13. The issue arises from improper neutralization of input during web page generation in the Call Home proxy server configuration. Specifically, the proxy server address parameter on /Archiver/CallHomeSettingsWizard.aspx can be manipulated by an authenticated attacker to inject arbitrary script or HTML. The injected payload is stored by the CallHomeSettingsWizard.SaveAllConfigSettings() function without output encoding, leading to script execution in the browsers of users who access the General Settings Additional Settings page.

An authenticated attacker can inject and store malicious scripts that execute in the context of users viewing the affected settings page, potentially leading to session hijacking, unauthorized actions, or other client-side impacts. The vulnerability requires authentication and user interaction to trigger the script execution. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected configuration pages to trusted administrators only and monitor for suspicious activity related to the Call Home proxy server settings. Avoid visiting the General Settings Additional Settings page if untrusted input may have been submitted.