Based on the updated description, GFI Archiver suffers a stored cross‑site scripting flaw in the Classification Rules configuration. Authenticated users can enter arbitrary JavaScript or HTML into the rule name and email criteria fields; the application stores the payload without applying output encoding. When another authorized user opens the Classification Rules page, the unsanitized content is rendered, causing script execution in their browser and enabling session hijacking, phishing, or defacement.

The vulnerability affects all GFI Archiver releases prior to version 15.14. The affected component is the CategorizationPolicyWizard.aspx page that handles rule editing. Only users with permission to configure classification rules can exploit the flaw.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The flaw is not listed in CISA’s KEV catalog, so no widespread attacks are documented. Exploitation requires an attacker to first authenticate to the Archiver system and then create a rule containing malicious script; the injected code will execute whenever another authorized user opens the rule configuration view.