CVE-2026-48537 is a stored cross-site scripting vulnerability affecting GFI Archiver before version 15.13. The issue arises from improper neutralization of input during web page generation in the File Archive Assistant configuration. Specifically, the excluded extensions parameter in /Archiver/FileArchiveAssistantWizard.aspx allows authenticated attackers to inject arbitrary scripts or HTML. The payload is stored by the FileArchiveAssistantWizard.btnSave_Click() method without output encoding, leading to script execution in the browsers of users who access the File Archive Assistant settings page.

Successful exploitation allows an authenticated attacker to execute arbitrary scripts in the context of users viewing the File Archive Assistant settings page. This can lead to session hijacking, unauthorized actions, or other impacts typical of stored XSS vulnerabilities. The vulnerability requires authentication and user interaction to trigger the payload execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the File Archive Assistant configuration page to trusted users only and consider applying web application firewall rules to detect and block suspicious input patterns targeting the excluded extensions parameter.