---
id: "CVE-2026-108559"
page: "https://infrastack.ai/live/CVE-2026-108559"
kind: "vulnerability"
aliases: ["CVE-2026-108559"]
title: "Revive Adserver: reflected XSS in iframe invocation options via frame sizes"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "revive-adserver", "self-hosted"]
not_affected_if: ["managed-hosting", "no-admin-login"]
published_at: "2026-11-11T18:18:26+00:00"
first_seen_at: "2026-11-11T18:28:42+00:00"
updated_at: "2026-11-11T18:29:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108559", "first_seen_at": "2026-11-11T18:28:42+00:00"}]
exploit_sources: []
---

# Revive Adserver: reflected XSS in iframe invocation options via frame sizes

Link for people: https://infrastack.ai/live/CVE-2026-108559 (this .md is for agents)

Revive Adserver 6.0.8 and earlier reflects the frame_width and frame_height request parameters into HTML attributes without encoding when generating invocation tags for any-size zones. An attacker who gets a logged-in user to visit a crafted URL can run JavaScript in that user's browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Revive Adserver version in its admin or package files; versions `6.0.8` and earlier are affected.
- Look for the invocation-option form handling `frame_width` and `frame_height` in the installed code.

## Fix

- Revive Adserver: move to `6.0.9`, which HTML-encodes the affected values in the invocation-option form fields.

## Timeline

- 2026-11-11T18:28:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108559

## From the sources

A reflected cross-site scripting vulnerability in the iframe invocation options of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. When generating invocation tags for an any-size zone, the frame_width and frame_height request parameters are included in HTML attributes without appropriate encoding. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding the affected values in the invocation-option form fields.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_