{"id":"CVE-2026-112333","kind":"vulnerability","aliases":["CVE-2026-112333"],"related":[],"title":"GFI Archiver: stored XSS in MailInsights report name runs in browsers","description":"GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.","summary":"GFI Archiver before 15.14 does not encode the report name of MailInsights scheduled reports, so HTML or script saved there is stored. The script runs in the browser of the user who later opens the MailInsights page, which can let an attacker act as that user in the Archiver web console.","severity":"medium","cvss":5.4,"epss":0.00235,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gfi-archiver","other","self-hosted","windows"],"not_affected_if":["auth-required","version-15.14-or-later"],"how_to_check":"- Check the installed GFI Archiver version in the product's About page or install folder; versions below `15.14` are in scope\n- Confirm whether the MailInsights scheduled report feature is in use at `/Archiver/MailInsights.aspx`","fix":"- Upgrade GFI Archiver to `15.14` or later\n- Until upgraded, limit who holds accounts that can create scheduled MailInsights reports","status":"open","published_at":"2026-10-23T15:17:24+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:14:15+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T04:14:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GFI Archiver to `15.14` or later\n- Until upgraded, limit who holds accounts that can create scheduled MailInsights reports","reach":"network","title":"GFI Archiver: stored XSS in MailInsights report name runs in browsers","impact":"medium","summary":"GFI Archiver before 15.14 does not encode the report name of MailInsights scheduled reports, so HTML or script saved there is stored. The script runs in the browser of the user who later opens the MailInsights page, which can let an attacker act as that user in the Archiver web console.","category":"other","nicknames":[],"who_cares":["gfi-archiver","self-hosted","windows"],"confidence":0.7,"needs_auth":"yes","worst_case":"Script runs in an administrator's browser session within the Archiver console","analyst_note":"","how_to_check":"- Check the installed GFI Archiver version in the product's About page or install folder; versions below `15.14` are in scope\n- Confirm whether the MailInsights scheduled report feature is in use at `/Archiver/MailInsights.aspx`","needs_analyst":false,"not_affected_if":["version-15.14-or-later","auth-required"],"who_is_affected":"Sites running GFI Archiver before 15.14 where users can log in and create MailInsights scheduled reports. The attacker needs an authenticated account, and the victim must later view the MailInsights page. Installations on 15.14 or later, or without any MailInsights reports in use, can skip this.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000615,"input_tokens":3383,"output_tokens":554,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112333':14A,17A '-2026':13A,16A '/archiver/mailinsights.aspx':112C '15.14':29B,80C 'act':68B 'allow':96C 'arbitrari':101C 'archiv':2A,20B,27B,74B,78C 'attack':67B,98C 'authent':97C 'browser':11A,53B,129C 'click':120C 'configur':94C 'consol':76B 'contain':81C 'creat':134C 'cross':85C 'cross-sit':84C 'cve':12A,15A 'encod':32B,123C 'execut':126C 'gfi':1A,19B,26B,77C 'gfi-archiv':18B 'host':24B 'html':41B,105C 'inject':100C,114C 'later':58B 'let':65B 'mailinsight':6A,37B,61B,91C,143C 'name':8A,35B,109C 'open':59B 'output':122C 'page':62B,144C 'paramet':110C 'payload':115C 'report':7A,34B,39B,93C,108C,137C 'reportscheduling.btnsavereport':119C 'run':9A,50B 'save':44B 'schedul':38B,92C,136C 'script':43B,49B,87C,103C 'self':23B 'self-host':22B 'site':86C 'store':3A,47B,83C,117C 'subsequ':140C 'user':56B,71B,132C 'via':106C 'view':141C 'vulner':88C 'web':75B,102C 'window':25B 'without':121C 'xss':4A","nicknames":[],"mitigations":[],"who_affected":"Sites running GFI Archiver before 15.14 where users can log in and create MailInsights scheduled reports. The attacker needs an authenticated account, and the victim must later view the MailInsights page. Installations on 15.14 or later, or without any MailInsights reports in use, can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112333","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112333","severity":null,"published_at":"2026-10-23T15:17:24+00:00","modified_at":"2026-10-23T15:17:24+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112333","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112333","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}