GFI Archiver contains a stored cross‑site scripting vulnerability that allows an authenticated attacker to inject arbitrary JavaScript or HTML into the policy name field on the File History Retention Policy configuration page. When the RetentionPolicyWizard.SaveAllConfigSettings() routine persists the value, it does not apply proper output encoding, so the script executes in the browsers of any user who later views the retention policies page. An attacker who can log in and create or modify a policy can therefore deface the interface, steal session cookies, or perform other client‑side attacks within the context of legitimate users. The weakness is a classic cross‑site scripting flaw (CWE‑79).

Any installation of GFI Archiver produced by GFI Software running a version earlier than 15.13 is impacted; the advisory does not list any sub‑sequences or hotfixes within those earlier releases.

The CVSS score of 5.1 indicates moderate severity while the EPSS score of less than 1% suggests that exploitation is currently considered unlikely. The vulnerability is not catalogued in CISA’s KEV. Exploitation requires an authenticated session with permission to create or modify retention policies, which limits the attack surface somewhat; however, once the payload is stored it executes for all users who view the policy page, so a malicious script can compromise multiple users’ browsers. The attack vector is via the Archiver web interface and relies on server‑side storage of unsanitized input.