CVE-2026-48537 is a stored cross-site scripting vulnerability in GFI Archiver prior to version 15.13. The issue arises from improper neutralization of input in the excluded extensions parameter of the File Archive Assistant configuration page (/Archiver/FileArchiveAssistantWizard.aspx). Authenticated users can inject malicious scripts that are stored by the FileArchiveAssistantWizard.btnSave_Click() function without output encoding. When other users access the File Archive Assistant settings page, the malicious script executes in their browsers, potentially leading to script-based attacks.

The vulnerability allows authenticated attackers to inject and store malicious scripts that execute in the context of other users' browsers when they view the File Archive Assistant settings page. This can lead to unauthorized actions performed on behalf of users, theft of session tokens, or other script-based attacks. The impact is limited to authenticated users and requires user interaction to view the affected page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the File Archive Assistant configuration page to trusted users only and consider monitoring for suspicious activity related to this functionality. Avoid using the affected feature if possible until patched.