{"id":"CVE-2026-108563","kind":"vulnerability","aliases":["CVE-2026-108563"],"related":[],"title":"Revive Adserver: conversion report exports can run formulas in spreadsheets","description":"Spreadsheet formula injection in conversion-tracking report exports in Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to submit conversion values that are written as formulas instead of text in an XLS workbook. When a user opens the exported report in a spreadsheet application, attacker-supplied formulas can be evaluated. The confirmed impact is formula execution within the workbook; disclosure of information to the attacker has not been established. The issue is fixed in Revive Adserver 6.0.9 by sanitising conversion values before writing them to the affected XLS report sections.","summary":"Revive Adserver writes unauthenticated conversion values into XLS report exports as formulas instead of text. When an administrator opens the exported workbook in a spreadsheet application, attacker-supplied formulas can be evaluated.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Revive Adserver","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","revive-adserver","self-hosted","spreadsheets"],"not_affected_if":["version-6.0.9-or-later"],"how_to_check":"- Check the installed Revive Adserver version; `6.0.8` and earlier are affected.\n- Confirm whether conversion-tracking report exports in XLS format are used.","fix":"- Revive Adserver: move to `6.0.9` or later.","status":"open","published_at":"2026-11-11T18:18:26+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","triaged_at":"2026-11-11T18:29:44+00:00","updated_at":"2026-11-11T18:29:44+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T18:29:44Z","model":"claude-haiku-5-5","output":{"fix":"- Revive Adserver: move to `6.0.9` or later.","reach":"internet","title":"Revive Adserver: conversion report exports can run formulas in spreadsheets","impact":"medium","summary":"Revive Adserver writes unauthenticated conversion values into XLS report exports as formulas instead of text. When an administrator opens the exported workbook in a spreadsheet application, attacker-supplied formulas can be evaluated.","audience":"businesses","category":"other","nicknames":[],"who_cares":["revive-adserver","self-hosted","spreadsheets"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"formulas run in a staff member's spreadsheet application","analyst_note":"","how_to_check":"- Check the installed Revive Adserver version; `6.0.8` and earlier are affected.\n- Confirm whether conversion-tracking report exports in XLS format are used.","plain_action":"","product_name":"Revive Adserver","needs_analyst":false,"not_affected_if":["version-6.0.9-or-later"],"who_is_affected":"Teams that run Revive Adserver with conversion tracking and whose staff open XLS report exports in a spreadsheet application. Exposure depends on attacker-submitted conversion values reaching the export. Deployments on `6.0.9` or later are not affected.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000725,"input_tokens":4657,"output_tokens":519,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-108563':13A,16A '-2026':12A,15A '6.0.8':72C '6.0.9':139C 'administr':44B 'adserv':2A,22B,28B,71C,138C 'adserver':18A 'affect':149C 'allow':75C 'applic':52B,105C 'attack':54B,78C,107C,127C 'attacker-suppli':53B,106C 'confirm':114C 'convers':3A,31B,65C,81C,142C 'conversion-track':64C 'cve':11A,14A 'disclosur':122C 'earlier':74C 'establish':131C 'evalu':59B,112C 'execut':118C 'export':5A,36B,47B,68C,100C 'fix':135C 'formula':8A,38B,56B,61C,87C,109C,117C 'host':25B 'impact':115C 'inform':124C 'inject':62C 'instead':39B,88C 'issu':133C 'open':45B,98C 'report':4A,35B,67C,101C,151C 'reviv':1A,21B,27B,70C,137C 'revive':17A 'revive-adserv':20B 'run':7A 'sanitis':141C 'section':152C 'self':24B 'self-host':23B 'spreadsheet':10A,26B,51B,60C,104C 'submit':80C 'suppli':55B,108C 'text':41B,90C 'track':66C 'unauthent':30B,77C 'user':97C 'valu':32B,82C,143C 'within':119C 'workbook':48B,94C,121C 'write':29B,145C 'written':85C 'xls':34B,93C,150C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Revive Adserver with conversion tracking and whose staff open XLS report exports in a spreadsheet application. Exposure depends on attacker-submitted conversion values reaching the export. Deployments on `6.0.9` or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adserver","reviveadserver"],"ptokens":["adserver","revive"],"labels":["medium","other","reviveadserver","selfhosted","spreadsheets","vendor"],"campaign_type":null,"search_a":"'-108563':13A,16A '-2026':12A,15A 'adserv':2A 'adserver':18A 'convers':3A 'cve':11A,14A 'export':5A 'formula':8A 'report':4A 'reviv':1A 'revive':17A 'run':7A 'spreadsheet':10A","search_b":"'administr':44B 'adserv':22B,28B 'applic':52B 'attack':54B 'attacker-suppli':53B 'convers':31B 'evalu':59B 'export':36B,47B 'formula':38B,56B 'host':25B 'instead':39B 'open':45B 'report':35B 'reviv':21B,27B 'revive-adserv':20B 'self':24B 'self-host':23B 'spreadsheet':26B,51B 'suppli':55B 'text':41B 'unauthent':30B 'valu':32B 'workbook':48B 'write':29B 'xls':34B","search_c":"'6.0.8':72C '6.0.9':139C 'adserv':71C,138C 'affect':149C 'allow':75C 'applic':105C 'attack':78C,107C,127C 'attacker-suppli':106C 'confirm':114C 'convers':65C,81C,142C 'conversion-track':64C 'disclosur':122C 'earlier':74C 'establish':131C 'evalu':112C 'execut':118C 'export':68C,100C 'fix':135C 'formula':61C,87C,109C,117C 'impact':115C 'inform':124C 'inject':62C 'instead':88C 'issu':133C 'open':98C 'report':67C,101C,151C 'reviv':70C,137C 'sanitis':141C 'section':152C 'spreadsheet':60C,104C 'submit':80C 'suppli':108C 'text':90C 'track':66C 'unauthent':77C 'user':97C 'valu':82C,143C 'within':119C 'workbook':94C,121C 'write':145C 'written':85C 'xls':93C,150C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108563","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108563","severity":null,"published_at":"2026-11-11T18:18:26+00:00","modified_at":"2026-11-11T18:18:26+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","fetched_at":"2026-11-11T18:28:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}