CVE-2026-48536 is a stored cross-site scripting vulnerability in GFI Archiver before version 15.13. The issue arises from improper neutralization of input during web page generation in the General Settings SMTP configuration. Specifically, the SMTP server address parameter passed to /Archiver/GeneralSettingsWizard.aspx is stored by the GeneralSettingsWizard.SaveAllConfigSettings() method without output encoding. This allows authenticated attackers to inject arbitrary scripts or HTML that execute in the context of users viewing the General Settings page, potentially leading to script execution in their browsers.

The vulnerability allows authenticated attackers to inject and store malicious scripts in the SMTP server address configuration. When other users access the General Settings page, the injected scripts execute in their browsers. This can lead to unauthorized actions performed in the context of the victim user, such as session hijacking or other client-side attacks. The CVSS 4.0 base score is 5.1, indicating a medium impact with network attack vector, low attack complexity, and requiring privileges and user interaction.

No official patch or remediation level has been confirmed from the vendor advisory. Users should upgrade to GFI Archiver version 15.13 or later once available, as versions prior to 15.13 are affected. Until a fix is applied, restrict access to the General Settings page to trusted administrators only and validate or sanitize inputs where possible. Monitor vendor communications for official patches or updates.