CVE-2026-48538 is a stored cross-site scripting vulnerability affecting GFI Archiver prior to version 15.13. The issue arises from improper neutralization of input during web page generation in the ImportSettingsWizard component. Authenticated users can inject malicious scripts via the configured folders parameter, which are stored by ImportSettingsWizard.SaveAllConfigSettings() without proper output encoding. When other users access the Archive Assistant default import settings, the malicious script executes in their browsers, potentially leading to script-based attacks.

The vulnerability allows authenticated attackers to inject and store malicious scripts that execute in the context of other users' browsers when they view the affected settings page. This can lead to unauthorized actions performed on behalf of users, data theft, or session hijacking. However, exploitation requires authentication and user interaction, limiting the scope of impact. The CVSS score of 5.1 reflects a medium severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the ImportSettingsWizard functionality to trusted users only and consider monitoring for suspicious activity related to the configured folders parameter. Avoid exposing the affected interface to untrusted users.