CVE-2026-108560: XSS
A reflected cross-site scripting vulnerability in updates-history.php in Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in a victim's browser by persuading them to visit a crafted URL. Attacker-controlled values are included in XML command attributes without appropriate encoding, allowing injection of executable XHTML into the response. The preliminary session check omits GET xajax requests, exposing an unauthenticated attack path, while authenticated administrator requests also reach the unsafe output. The issue is fixed in Revive Adserver 6.0.9 by applying the session check to both GET and POST requests and encoding XML command attribute values in both response serializers.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Revive Adserverto a version that resolves this vulnerability.Fixed in 6.0.9
Event History
Frequently Asked Questions
Which deployments are exposed to the unauthenticated attack path?
Revive Adserver 6.0.8 and earlier are affected where updates-history.php is reachable. The vulnerable path uses GET xajax requests that bypass the preliminary session check, so the attacker does not need an account.
What does an attacker need to successfully exploit this issue?
The attacker needs to persuade a victim to visit a crafted URL. Successful exploitation executes attacker-controlled JavaScript in the victim's browser; authenticated administrator requests can also reach the unsafe output.
Are default protections sufficient to prevent exploitation?
No. The described GET xajax path omits the preliminary session check, creating an unauthenticated route to the unsafe response handling.
What remediation is available?
Upgrade to Revive Adserver 6.0.9. That release applies the session check to both GET and POST requests and encodes XML command attribute values in both response serializers.