CVE-2026-48539 is a stored cross-site scripting vulnerability in GFI Archiver prior to version 15.13. The vulnerability exists in the MailInsights scheduled report configuration feature, specifically via the report name parameter submitted to /Archiver/MailInsights.aspx. The ReportScheduling.btnSaveReport_Click() function stores the injected script or HTML without output encoding, causing the payload to execute in the context of the user who created the scheduled report upon viewing the MailInsights page. This requires the attacker to be authenticated and have permission to create scheduled reports.

An authenticated attacker can inject and store malicious scripts that execute in the browser of the user who created the scheduled report. This could lead to session hijacking, unauthorized actions, or other attacks within the context of the affected user. The vulnerability does not require user interaction beyond viewing the MailInsights page and has a medium severity with a CVSS 4.0 base score of 5.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the MailInsights scheduled report configuration to trusted users only and consider monitoring for suspicious activity related to report creation and viewing. Avoid using the report name parameter with untrusted input.