A flaw in Revive Adserver versions 6.0.6 and earlier allows a low‑privileged user to submit delivery limitations that are not properly validated. The unsanitized logical parameter can contain PHP code, which is stored in the compiledlimitations field and executed when banners are served, giving the attacker the ability to run arbitrary PHP scripts on the hosting system. This results in full control over the web application and potentially the underlying server.

The vulnerability affects Revive Adserver versions 6.0.6 and earlier. Versions newer than 6.0.6 include input sanitisation and are not impacted.

The CVSS score of 8.8 indicates high severity. EPSS data is not available, so the exact current exploitation probability is unknown, and the vulnerability is not listed in CISA’s KEV catalog. Likely attack vectors include a low‑privileged user within the admin interface submitting a crafted delivery limitation; no elevated privileges or external network exposure are required beyond normal administrative access.