CVE-2026-108559: XSS
A reflected cross-site scripting vulnerability in the iframe invocation options of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. When generating invocation tags for an any-size zone, the framewidth and frameheight request parameters are included in HTML attributes without appropriate encoding. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding the affected values in the invocation-option form fields.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Revive Adserverto a version that resolves this vulnerability.Fixed in 6.0.9
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running Revive Adserver 6.0.8 or earlier are affected when users generate invocation tags for an any-size zone. Exploitation targets an authenticated user's browser, although the attacker does not need to authenticate.
What does an attacker need to exploit it?
The attacker needs to persuade an authenticated user to visit a crafted URL. The malicious values are supplied through the frame_width and frame_height request parameters.
Is there a fix available?
Yes. Revive Adserver 6.0.9 fixes the issue by HTML-encoding the affected frame_width and frame_height values in the invocation-option form fields.
How can I determine whether my deployment is affected?
Check the deployed Revive Adserver version and whether it is 6.0.8 or earlier. The vulnerable behavior is specifically associated with invocation-tag generation for any-size zones using frame_width or frame_height request parameters.