{"id":"CVE-2026-108561","kind":"vulnerability","aliases":["CVE-2026-108561"],"related":[],"title":"Revive Adserver: crafted report link runs JavaScript in admin browsers","description":"A stored cross-site scripting vulnerability in the report date-selection controls of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in a victim's browser by persuading them to follow a crafted report URL and complete normal reauthentication. An attacker-controlled period_preset value can be saved in the victim's session and inserted into JavaScript without appropriate encoding. The payload can execute on the initial report view and subsequent report views using the stored defaults. The issue is fixed in Revive Adserver 6.0.9 by applying JSON encoding appropriate for the JavaScript context to date-selection values.","summary":"Revive Adserver's report date-selection controls store an attacker-supplied period_preset value in the victim's session and insert it into JavaScript without encoding. A victim who opens a crafted report URL and reauthenticates runs the attacker's script in their browser, on that view and later report views.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Revive Adserver","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","php","revive-adserver","self-hosted"],"not_affected_if":["version-6.0.9-or-later"],"how_to_check":"- Check the installed Revive Adserver version in the admin footer or its package metadata; versions `6.0.8` and earlier are affected.\n- Confirm whether report pages are reachable by administrators from the internet or only from an internal network.","fix":"- Revive Adserver: upgrade to `6.0.9`, which applies JSON encoding to date-selection values.","status":"open","published_at":"2026-11-11T18:18:26+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","triaged_at":"2026-11-11T18:29:32+00:00","updated_at":"2026-11-11T18:29:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T18:29:32Z","model":"claude-haiku-5-5","output":{"fix":"- Revive Adserver: upgrade to `6.0.9`, which applies JSON encoding to date-selection values.","reach":"internet","title":"Revive Adserver: crafted report link runs JavaScript in admin browsers","impact":"medium","summary":"Revive Adserver's report date-selection controls store an attacker-supplied period_preset value in the victim's session and insert it into JavaScript without encoding. A victim who opens a crafted report URL and reauthenticates runs the attacker's script in their browser, on that view and later report views.","audience":"businesses","category":"package","nicknames":[],"who_cares":["revive-adserver","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker script runs in the victim's browser session on the ad server","analyst_note":"","how_to_check":"- Check the installed Revive Adserver version in the admin footer or its package metadata; versions `6.0.8` and earlier are affected.\n- Confirm whether report pages are reachable by administrators from the internet or only from an internal network.","plain_action":"","product_name":"Revive Adserver","needs_analyst":false,"not_affected_if":["version-6.0.9-or-later"],"who_is_affected":"Teams running self-hosted Revive Adserver `6.0.8` or earlier with the reporting interface in use. The attack needs a victim to follow a crafted link and sign in again, so exposure is highest where administrators use reports from untrusted links. Installations already on `6.0.9` or later are not affected.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000759,"input_tokens":4672,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-108561':13A,16A '-2026':12A,15A '6.0.8':97C '6.0.9':171C 'admin':9A 'adserv':2A,23B,28B,96C,170C 'adserver':18A 'allow':100C 'appli':173C 'appropri':145C,176C 'attack':38B,67B,103C,127C 'attacker-control':126C 'attacker-suppli':37B 'browser':10A,72B,111C 'complet':122C 'context':180C 'control':34B,93C,128C 'craft':3A,60B,118C 'cross':83C 'cross-sit':82C 'cve':11A,14A 'date':32B,91C,183C 'date-select':31B,90C,182C 'default':163C 'earlier':99C 'encod':54B,146C,175C 'execut':105C,150C 'fix':167C 'follow':116C 'host':26B 'initi':153C 'insert':49B,141C 'issu':165C 'javascript':7A,52B,106C,143C,179C 'json':174C 'later':77B 'link':5A 'normal':123C 'open':58B 'packag':19B 'payload':148C 'period':40B,129C 'persuad':113C 'php':20B 'preset':41B,130C 'reauthent':64B,124C 'report':4A,30B,61B,78B,89C,119C,154C,158C 'reviv':1A,22B,27B,95C,169C 'revive':17A 'revive-adserv':21B 'run':6A,65B 'save':134C 'script':69B,85C 'select':33B,92C,184C 'self':25B 'self-host':24B 'session':47B,139C 'site':84C 'store':35B,81C,162C 'subsequ':157C 'suppli':39B 'unauthent':102C 'url':62B,120C 'use':160C 'valu':42B,131C,185C 'victim':45B,56B,109C,137C 'view':75B,79B,155C,159C 'vulner':86C 'without':53B,144C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Revive Adserver `6.0.8` or earlier with the reporting interface in use. The attack needs a victim to follow a crafted link and sign in again, so exposure is highest where administrators use reports from untrusted links. Installations already on `6.0.9` or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adserver","reviveadserver"],"ptokens":["adserver","revive"],"labels":["medium","package","php","reviveadserver","selfhosted","vendor"],"campaign_type":null,"search_a":"'-108561':13A,16A '-2026':12A,15A 'admin':9A 'adserv':2A 'adserver':18A 'browser':10A 'craft':3A 'cve':11A,14A 'javascript':7A 'link':5A 'report':4A 'reviv':1A 'revive':17A 'run':6A","search_b":"'adserv':23B,28B 'attack':38B,67B 'attacker-suppli':37B 'browser':72B 'control':34B 'craft':60B 'date':32B 'date-select':31B 'encod':54B 'host':26B 'insert':49B 'javascript':52B 'later':77B 'open':58B 'packag':19B 'period':40B 'php':20B 'preset':41B 'reauthent':64B 'report':30B,61B,78B 'reviv':22B,27B 'revive-adserv':21B 'run':65B 'script':69B 'select':33B 'self':25B 'self-host':24B 'session':47B 'store':35B 'suppli':39B 'url':62B 'valu':42B 'victim':45B,56B 'view':75B,79B 'without':53B","search_c":"'6.0.8':97C '6.0.9':171C 'adserv':96C,170C 'allow':100C 'appli':173C 'appropri':145C,176C 'attack':103C,127C 'attacker-control':126C 'browser':111C 'complet':122C 'context':180C 'control':93C,128C 'craft':118C 'cross':83C 'cross-sit':82C 'date':91C,183C 'date-select':90C,182C 'default':163C 'earlier':99C 'encod':146C,175C 'execut':105C,150C 'fix':167C 'follow':116C 'initi':153C 'insert':141C 'issu':165C 'javascript':106C,143C,179C 'json':174C 'normal':123C 'payload':148C 'period':129C 'persuad':113C 'preset':130C 'reauthent':124C 'report':89C,119C,154C,158C 'reviv':95C,169C 'save':134C 'script':85C 'select':92C,184C 'session':139C 'site':84C 'store':81C,162C 'subsequ':157C 'unauthent':102C 'url':120C 'use':160C 'valu':131C,185C 'victim':109C,137C 'view':155C,159C 'vulner':86C 'without':144C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108561","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108561","severity":null,"published_at":"2026-11-11T18:18:26+00:00","modified_at":"2026-11-11T18:18:26+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","fetched_at":"2026-11-11T18:28:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}