EUVD-2026-38507
GHSA-qxq8-64vv-45v8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain low-priv advertiser account
-
DeliveryOpen banner delivery limitations editor
-
ExploitInject PHP via logical parameter
-
InstallPayload stored in compiledlimitations column
-
C2Trigger banner delivery request
-
ExecuteServer executes injected PHP
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privileged Revive Adserver account (PR:L) with permission to create or edit a banner's delivery limitations - typically an advertiser or trafficker role - on an instance running version 6.0.6 or earlier. The injected payload only fires when the affected banner is actually delivered to an ad request, so a campaign/banner must be active and reachable; limiting factors are therefore the need for valid credentials and the requirement that the targeted banner be in a serving state. No user interaction is needed (UI:N) and the vector is network-reachable via the admin web UI. |
| Impact | The CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) accurately reflects authenticated RCE: any account that can edit a banner's delivery limitations - typically advertiser or trafficker roles, not just super-admin - can fully compromise the host. The execution is stored and triggered on ad delivery, meaning every public impression of the affected banner re-triggers the injected code, which raises both reliability and stealth of exploitation. EPSS and KEV data were not provided in the input, and no public exploit identified at time of analysis, so probability of mass exploitation cannot be quantified; however, the attack surface (low-priv web UI) and trigger mechanism (automatic during delivery) make this a credible priority for any internet-exposed Revive instance. Limiting factor: PR:L means an attacker must first obtain a valid Revive account, so risk concentrates on multi-tenant or self-registration deployments. |
| Exploit ScenarioDerived | An attacker registers or compromises a low-privileged advertiser account on a Revive Adserver instance, opens a banner's delivery limitations editor, and supplies a malicious value in the 'logical' parameter that breaks out of the intended PHP expression to inject arbitrary code. The payload is stored in compiledlimitations and executes server-side every time the banner is served to a visitor, giving the attacker reliable RCE as the web user without further interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 23, 2026
Authenticated PHP code injection in Revive Adserver 6.0.6 and earlier allows a low-privileged user to embed arbitrary PHP into the compiledlimitations database field via the logical parameter of delivery limitations, with execution occurring later during banner delivery. The flaw is exploitable over the network with low complexity and yields full confidentiality, integrity, and availability impact (CVSS 8.8), though no public exploit identified at time of analysis.
RemediationAI
Upgrade to the version released after 6.0.6 that contains the improved input sanitisation for the logical parameter; the input data references the HackerOne disclosure at https://hackerone.com/reports/3656781 but does not name an exact fixed release, so verify the fixed version against the official Revive security advisory page before deploying. As compensating controls until patched, restrict who holds advertiser/trafficker privileges and audit recent edits to delivery limitations for suspicious values in the logical field or compiledlimitations column, and consider blocking external access to the admin UI (typically /www/admin/) via IP allow-list or WAF rules that reject non-boolean tokens in the logical parameter - note this will break legitimate UI edits if rules are too aggressive. Disabling self-registration of advertiser accounts is also strongly recommended for any internet-facing instance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Revive Adserver is an open-source PHP ad-serving platform (forked from OpenX) used to manage and deliver banner campaigns. Delivery limitations are rules (geo, time, frequency, etc.) attached to banners; they are compiled into PHP expressions and persisted in the compiledlimitations column, then eval'd or otherwise executed by the delivery engine for each ad impression. CWE-94 (Improper Control of Generation of Code) applies because the 'logical' parameter - intended to be a simple boolean/operator token (e.g. and/or) - was concatenated into the compiled PHP without validation, allowing attacker-controlled PHP to be stored and later executed. CPE cpe:2.3:a:revive_adserver:revive_adserver:*:*:*:*:*:*:*:* covers all versions up to and including 6.0.6.
Know when Revive Adserver gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable admin UI (AV:N), straightforward injection (AC:L), requires authenticated low-priv account (PR:L), no user interaction, stored RCE yields full CIA impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
DescriptionCVE.org
A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to use the logical parameter to inject malicious PHP code into the compiledlimitations field on the database and have it executed during banner delivery. Input sanitisation has been improved to ensure that the parameter is properly validated.
Articles & Coverage 2
Executive ViewAI
Revive Adserver 6.0.6 and earlier contains a critical authenticated code injection vulnerability exploitable by low-privileged users, enabling arbitrary code execution during banner delivery that compromises customer data, transaction integrity, and ad infrastructure. No public exploit identified at time of analysis; however, the lack of available patch creates immediate insider-threat exposure requiring urgent access control remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict delivery-limitations feature access to administrative staff only; (2) Deploy Web Application Firewall rules to block PHP injection patterns ('<?php', 'eval(', 'system()') in the logical parameter; (3) Implement network segmentation between Revive Adserver instances and critical backend systems; (4) Enable comprehensive audit logging for delivery-limitations configuration changes and banner delivery operations; (5) Disable the delivery-limitations feature entirely if not required by business operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Revive Adserver
View allAn attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() cal
Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change othe
Authenticated SQL injection in Revive Adserver 6.0.0 allows a logged-in user to execute crafted payloads that can disrup
Use of cryptographically weak PRNG in the password recovery token generation of Revive Adserver < v4.2.1 causes a potent
Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack
Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure uniqi
A security restriction bypass vulnerability has been discovered in Revive Adserver version < 5.0.5 by HackerOne user hoa
HackerOne community member Dang Hung Vi (vidang04) has reported an uncontrolled resource consumption vulnerability in th
Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete
Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies relate
Reflected cross-site scripting in the Revive Adserver administrative interface (verified against version 5.5.2, with a 6
Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script.
Exploit-DB