CVE-2026-48539 is a stored cross-site scripting vulnerability in GFI Archiver prior to version 15.13. The flaw exists in the MailInsights scheduled report configuration feature, where the report name parameter is not properly neutralized before being stored by the ReportScheduling.btnSaveReport_Click() function. This allows an authenticated attacker to inject malicious scripts or HTML that execute in the context of the user who created the scheduled report upon viewing the MailInsights page. The vulnerability requires authentication and user interaction, and it has a low complexity for exploitation with no privileges beyond authenticated user level.

An authenticated attacker can execute arbitrary scripts in the context of the victim user who views the scheduled report, potentially leading to session hijacking, unauthorized actions, or data disclosure within the affected application context. The impact is limited to users who create and view scheduled reports in MailInsights. There is no indication of remote code execution or privilege escalation beyond the authenticated user scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor GFI Software advisories for updates. Until a patch is available, restrict access to the MailInsights scheduled report configuration to trusted users only and consider applying input validation or output encoding workarounds if feasible.