---
id: "CVE-2026-112333"
kind: "vulnerability"
aliases: ["CVE-2026-112333"]
title: "GFI Archiver: stored XSS in MailInsights report name runs in browsers"
severity: "medium"
cvss: 5.4
epss: 0.00235
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["gfi-archiver", "other", "self-hosted", "windows"]
not_affected_if: ["auth-required", "version-15.14-or-later"]
published_at: "2026-10-23T15:17:24+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112333", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112333", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# GFI Archiver: stored XSS in MailInsights report name runs in browsers

GFI Archiver before 15.14 does not encode the report name of MailInsights scheduled reports, so HTML or script saved there is stored. The script runs in the browser of the user who later opens the MailInsights page, which can let an attacker act as that user in the Archiver web console.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GFI Archiver version in the product's About page or install folder; versions below `15.14` are in scope
- Confirm whether the MailInsights scheduled report feature is in use at `/Archiver/MailInsights.aspx`

## Fix

- Upgrade GFI Archiver to `15.14` or later
- Until upgraded, limit who holds accounts that can create scheduled MailInsights reports

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112333
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112333

## From the sources

GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_