---
id: "CVE-2026-108563"
page: "https://infrastack.ai/live/CVE-2026-108563"
kind: "vulnerability"
aliases: ["CVE-2026-108563"]
title: "Revive Adserver: conversion report exports can run formulas in spreadsheets"
severity: "medium"
cvss: 4.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Revive Adserver", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["other", "revive-adserver", "self-hosted", "spreadsheets"]
not_affected_if: ["version-6.0.9-or-later"]
published_at: "2026-11-11T18:18:26+00:00"
first_seen_at: "2026-11-11T18:28:42+00:00"
updated_at: "2026-11-11T18:29:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108563", "first_seen_at": "2026-11-11T18:28:42+00:00"}]
exploit_sources: []
---

# Revive Adserver: conversion report exports can run formulas in spreadsheets

Link for people: https://infrastack.ai/live/CVE-2026-108563 (this .md is for agents)

Revive Adserver writes unauthenticated conversion values into XLS report exports as formulas instead of text. When an administrator opens the exported workbook in a spreadsheet application, attacker-supplied formulas can be evaluated.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Revive Adserver affected range not listed fixed no fixed version listed

## How to check

- Check the installed Revive Adserver version; `6.0.8` and earlier are affected.
- Confirm whether conversion-tracking report exports in XLS format are used.

## Fix

- Revive Adserver: move to `6.0.9` or later.

## Timeline

- 2026-11-11T18:28:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108563

## From the sources

Spreadsheet formula injection in conversion-tracking report exports in Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to submit conversion values that are written as formulas instead of text in an XLS workbook. When a user opens the exported report in a spreadsheet application, attacker-supplied formulas can be evaluated. The confirmed impact is formula execution within the workbook; disclosure of information to the attacker has not been established. The issue is fixed in Revive Adserver 6.0.9 by sanitising conversion values before writing them to the affected XLS report sections.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_