CVE-2026-44959: Code Injection
A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. A low‑privileged user could add an unexpected component parameter and inject malicious PHP code into the compiledlimitations field, which would then be executed during banner delivery. Input sanitisation has been improved to ensure that unexpected parameters are filtered out.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44959?
The severity of CVE-2026-44959 is high, rated at 8.8.
How do I fix CVE-2026-44959?
To fix CVE-2026-44959, upgrade to Revive Adserver version 6.0.7 or later where the vulnerability has been addressed.
What impact does CVE-2026-44959 have on Revive Adserver?
CVE-2026-44959 allows low-privileged users to inject malicious PHP code into delivery limitations, leading to execution during banner delivery.
What type of vulnerability is CVE-2026-44959?
CVE-2026-44959 is classified as a code injection vulnerability.
Who is affected by CVE-2026-44959?
Users of Revive Adserver version 6.0.6 and earlier are affected by CVE-2026-44959.