{"id":"CVE-2026-108559","kind":"vulnerability","aliases":["CVE-2026-108559"],"related":[],"title":"Revive Adserver: reflected XSS in iframe invocation options via frame sizes","description":"A reflected cross-site scripting vulnerability in the iframe invocation options of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. When generating invocation tags for an any-size zone, the frame_width and frame_height request parameters are included in HTML attributes without appropriate encoding. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding the affected values in the invocation-option form fields.","summary":"Revive Adserver 6.0.8 and earlier reflects the frame_width and frame_height request parameters into HTML attributes without encoding when generating invocation tags for any-size zones. An attacker who gets a logged-in user to visit a crafted URL can run JavaScript in that user's browser.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","revive-adserver","self-hosted"],"not_affected_if":["managed-hosting","no-admin-login"],"how_to_check":"- Check the installed Revive Adserver version in its admin or package files; versions `6.0.8` and earlier are affected.\n- Look for the invocation-option form handling `frame_width` and `frame_height` in the installed code.","fix":"- Revive Adserver: move to `6.0.9`, which HTML-encodes the affected values in the invocation-option form fields.","status":"open","published_at":"2026-11-11T18:18:26+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","triaged_at":"2026-11-11T18:29:33+00:00","updated_at":"2026-11-11T18:29:33+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T18:29:33Z","model":"claude-haiku-5-5","output":{"fix":"- Revive Adserver: move to `6.0.9`, which HTML-encodes the affected values in the invocation-option form fields.","reach":"internet","title":"Revive Adserver: reflected XSS in iframe invocation options via frame sizes","impact":"medium","summary":"Revive Adserver 6.0.8 and earlier reflects the frame_width and frame_height request parameters into HTML attributes without encoding when generating invocation tags for any-size zones. An attacker who gets a logged-in user to visit a crafted URL can run JavaScript in that user's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["revive-adserver","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs JavaScript in a logged-in admin's browser session","analyst_note":"","how_to_check":"- Check the installed Revive Adserver version in its admin or package files; versions `6.0.8` and earlier are affected.\n- Look for the invocation-option form handling `frame_width` and `frame_height` in the installed code.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","no-admin-login"],"who_is_affected":"Sites running Revive Adserver 6.0.8 or earlier with the admin interface in use. The attack needs an authenticated admin or user to open a crafted link, so instances where no one signs in to the admin UI are lower risk. Hosted or managed Revive installs depend on the provider's patching.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000749,"input_tokens":4643,"output_tokens":569,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-108559':14A,17A '-2026':13A,16A '6.0.8':28B,91C '6.0.9':148C 'adserv':2A,22B,27B,90C,147C 'affect':154C 'allow':94C 'any-s':50B,121C 'appropri':139C 'attack':55B,97C 'attribut':42B,137C 'authent':103C 'browser':75B,106C 'craft':66B,113C 'cross':79C 'cross-sit':78C 'cve':12A,15A 'earlier':30B,93C 'encod':44B,140C,152C 'execut':99C 'field':162C 'fix':144C 'form':161C 'frame':10A,33B,36B,126C,129C 'generat':46B,116C 'get':57B 'height':37B,130C 'host':25B 'html':41B,136C,151C 'html-encod':150C 'ifram':6A,85C 'includ':134C 'invoc':7A,47B,86C,117C,159C 'invocation-opt':158C 'issu':142C 'javascript':70B,100C 'log':60B 'logged-in':59B 'option':8A,87C,160C 'packag':18B 'paramet':39B,132C 'persuad':108C 'php':19B 'reflect':3A,31B,77C 'request':38B,131C 'reviv':1A,21B,26B,89C,146C 'revive-adserv':20B 'run':69B 'script':81C 'self':24B 'self-host':23B 'site':80C 'size':11A,52B,123C 'tag':48B,118C 'unauthent':96C 'url':67B,114C 'user':62B,73B,104C 'valu':155C 'via':9A 'visit':64B,111C 'vulner':82C 'width':34B,127C 'without':43B,138C 'xss':4A 'zone':53B,124C","nicknames":[],"mitigations":[],"who_affected":"Sites running Revive Adserver 6.0.8 or earlier with the admin interface in use. The attack needs an authenticated admin or user to open a crafted link, so instances where no one signs in to the admin UI are lower risk. Hosted or managed Revive installs depend on the provider's patching.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","php","reviveadserver","selfhosted"],"campaign_type":null,"search_a":"'-108559':14A,17A '-2026':13A,16A 'adserv':2A 'cve':12A,15A 'frame':10A 'ifram':6A 'invoc':7A 'option':8A 'reflect':3A 'reviv':1A 'size':11A 'via':9A 'xss':4A","search_b":"'6.0.8':28B 'adserv':22B,27B 'any-s':50B 'attack':55B 'attribut':42B 'browser':75B 'craft':66B 'earlier':30B 'encod':44B 'frame':33B,36B 'generat':46B 'get':57B 'height':37B 'host':25B 'html':41B 'invoc':47B 'javascript':70B 'log':60B 'logged-in':59B 'packag':18B 'paramet':39B 'php':19B 'reflect':31B 'request':38B 'reviv':21B,26B 'revive-adserv':20B 'run':69B 'self':24B 'self-host':23B 'size':52B 'tag':48B 'url':67B 'user':62B,73B 'visit':64B 'width':34B 'without':43B 'zone':53B","search_c":"'6.0.8':91C '6.0.9':148C 'adserv':90C,147C 'affect':154C 'allow':94C 'any-s':121C 'appropri':139C 'attack':97C 'attribut':137C 'authent':103C 'browser':106C 'craft':113C 'cross':79C 'cross-sit':78C 'earlier':93C 'encod':140C,152C 'execut':99C 'field':162C 'fix':144C 'form':161C 'frame':126C,129C 'generat':116C 'height':130C 'html':136C,151C 'html-encod':150C 'ifram':85C 'includ':134C 'invoc':86C,117C,159C 'invocation-opt':158C 'issu':142C 'javascript':100C 'option':87C,160C 'paramet':132C 'persuad':108C 'reflect':77C 'request':131C 'reviv':89C,146C 'script':81C 'site':80C 'size':123C 'tag':118C 'unauthent':96C 'url':114C 'user':104C 'valu':155C 'visit':111C 'vulner':82C 'width':127C 'without':138C 'zone':124C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108559","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108559","severity":null,"published_at":"2026-11-11T18:18:26+00:00","modified_at":"2026-11-11T18:18:26+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","fetched_at":"2026-11-11T18:28:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}