---
id: "CVE-2026-108561"
page: "https://infrastack.ai/live/CVE-2026-108561"
kind: "vulnerability"
aliases: ["CVE-2026-108561"]
title: "Revive Adserver: crafted report link runs JavaScript in admin browsers"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Revive Adserver", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["package", "php", "revive-adserver", "self-hosted"]
not_affected_if: ["version-6.0.9-or-later"]
published_at: "2026-11-11T18:18:26+00:00"
first_seen_at: "2026-11-11T18:28:42+00:00"
updated_at: "2026-11-11T18:29:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108561", "first_seen_at": "2026-11-11T18:28:42+00:00"}]
exploit_sources: []
---

# Revive Adserver: crafted report link runs JavaScript in admin browsers

Link for people: https://infrastack.ai/live/CVE-2026-108561 (this .md is for agents)

Revive Adserver's report date-selection controls store an attacker-supplied period_preset value in the victim's session and insert it into JavaScript without encoding. A victim who opens a crafted report URL and reauthenticates runs the attacker's script in their browser, on that view and later report views.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Revive Adserver affected range not listed fixed no fixed version listed

## How to check

- Check the installed Revive Adserver version in the admin footer or its package metadata; versions `6.0.8` and earlier are affected.
- Confirm whether report pages are reachable by administrators from the internet or only from an internal network.

## Fix

- Revive Adserver: upgrade to `6.0.9`, which applies JSON encoding to date-selection values.

## Timeline

- 2026-11-11T18:28:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108561

## From the sources

A stored cross-site scripting vulnerability in the report date-selection controls of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in a victim's browser by persuading them to follow a crafted report URL and complete normal reauthentication. An attacker-controlled period_preset value can be saved in the victim's session and inserted into JavaScript without appropriate encoding. The payload can execute on the initial report view and subsequent report views using the stored defaults. The issue is fixed in Revive Adserver 6.0.9 by applying JSON encoding appropriate for the JavaScript context to date-selection values.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_