CVE-2026-48538 is a stored cross-site scripting vulnerability affecting GFI Archiver before version 15.13. The issue arises from improper neutralization of input during web page generation in the ImportSettingsWizard component. Authenticated attackers can inject malicious scripts through the configured folders parameter to /Archiver/ImportSettingsWizard.ashx. These scripts are stored by the ImportSettingsWizard.SaveAllConfigSettings() function without output encoding, leading to execution in the browsers of users who access the affected import settings page. This vulnerability requires authentication and user interaction to exploit and has a medium impact severity.

An authenticated attacker can inject and store malicious scripts that execute in the browsers of users who view the affected import settings page. This can lead to unauthorized actions performed in the context of the victim's browser session, potentially compromising user data or session integrity. However, the vulnerability does not allow privilege escalation or direct system compromise based on the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the ImportSettingsWizard functionality to trusted users only and consider monitoring for suspicious activity related to the import settings configuration. Avoid viewing or interacting with the default import settings page from untrusted sources.