CVE-2026-112333 GFI Archiver < 15.14 Stored XSS via MailInsights.aspx
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-112333?
CVE-2026-112333 is a medium-severity vulnerability in GFI Archiver, published on 23 Oct 2026.
Official description
GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.
Weakness: CWE-79
Which versions are affected by CVE-2026-112333?
How do I fix CVE-2026-112333?
No fix has been published for CVE-2026-112333 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-112333 being exploited?
There is no known exploitation of CVE-2026-112333 in the wild and no public exploit code.
Sources
Also known as GHSA-4cw6-7r4w-2x8v.