CVE-2026-48536 is a stored cross-site scripting vulnerability in GFI Archiver prior to version 15.13. The issue arises because the SMTP server address parameter in the General Settings SMTP configuration is not properly neutralized during web page generation. Authenticated attackers can inject malicious scripts that are stored by the GeneralSettingsWizard.SaveAllConfigSettings() function without output encoding. When other users access the General Settings page, the malicious script executes in their browsers, potentially leading to unauthorized actions or data exposure within the context of the affected application.

The vulnerability allows authenticated users to inject and store malicious scripts that execute in the browsers of other users who view the General Settings page. This can lead to session hijacking, unauthorized actions, or data theft within the application context. The CVSS 4.0 score of 5.1 indicates a medium impact with network attack vector, low attack complexity, and requiring privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the General Settings page to trusted users only and consider monitoring for suspicious activity related to SMTP configuration changes. Avoid using the affected SMTP server address parameter for untrusted input. Follow vendor advisories for updates on patches or official mitigations.