Spreadsheet Formula Injection Vulnerability in Revive Adserver by Revive Adserver

CVE-2026-108563

What is CVE-2026-108563?

An issue exists in Revive Adserver versions 6.0.8 and earlier, where a spreadsheet formula injection vulnerability allows unauthorized users to manipulate conversion values exported in tracking reports. Attackers can submit values that are interpreted as formulas rather than plain text. When these reports are opened in a spreadsheet application, the attacker-supplied formulas can be executed, potentially leading to undesirable actions or exploitation of the file. This vulnerability is addressed in version 6.0.9, which includes sanitization measures for conversion values prior to their inclusion in exported XLS reports.

References