CVE-2026-34916 Overview
CVE-2026-34916 is a PHP code injection vulnerability in Revive Adserver 6.0.6 and earlier. The flaw stems from missing validation of user input when saving delivery limitations. A low-privileged authenticated user can abuse the logical parameter to inject arbitrary PHP code into the compiledlimitations field stored in the database. The injected code executes during banner delivery, granting code execution in the context of the web application. The issue is tracked under CWE-94: Improper Control of Generation of Code. Revive Adserver addressed the issue by improving input sanitization to properly validate the affected parameter.
Critical Impact
Authenticated attackers with low privileges can achieve remote PHP code execution on the ad server, compromising confidentiality, integrity, and availability of the host.
Affected Products
- Revive Adserver 6.0.6
- Revive Adserver versions prior to 6.0.6
- Deployments exposing the delivery limitations management interface to low-privileged users
Discovery Timeline
- 2026-06-23 - CVE-2026-34916 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-34916
Vulnerability Analysis
Revive Adserver applies delivery limitations to control when and where banners are served. When an administrator or operator saves these limitations, the application persists a compiled representation of the logical expression in the compiledlimitations database column. This compiled string is later evaluated as PHP code during the banner delivery flow.
Because the logical parameter accepted from the user is not validated against an allowlist of expected logical operators, an authenticated user can supply arbitrary PHP syntax. The injected payload is concatenated into the stored compiled expression and executed when a request triggers banner delivery, yielding arbitrary code execution under the web server account.
Root Cause
The root cause is missing input validation on the logical parameter when persisting delivery limitation records. Revive Adserver expected a constrained set of logical operator tokens but did not enforce that constraint server-side. Combined with downstream use of PHP eval-style evaluation against the stored expression, untrusted input flowed directly into the code execution path, satisfying the conditions for CWE-94.
Attack Vector
Exploitation requires network access to the Revive Adserver management interface and an account with permission to edit delivery limitations. The attacker submits a crafted limitation record containing a malicious logical value. After saving, any subsequent banner delivery request triggers execution of the attacker-controlled PHP. The vulnerability is exploitable over the network with low complexity and no user interaction. See the HackerOne Security Report for the disclosed technical context.
Detection Methods for CVE-2026-34916
Indicators of Compromise
- Unexpected PHP syntax such as function calls, backticks, or ; separators inside the compiledlimitations column of the Revive Adserver database.
- New or modified delivery limitation records authored by low-privileged accounts shortly before anomalous web server child processes spawn.
- Outbound network connections initiated by the PHP-FPM or Apache worker serving banner delivery endpoints.
- Web access logs showing banner delivery requests immediately followed by writes to filesystem locations outside the Revive web root.
Detection Strategies
- Inspect the acls and related tables for compiledlimitations values that do not match the expected pattern of compiled logical expressions.
- Enable PHP auditlog or OPcache logging to capture dynamic code evaluation during delivery requests.
- Correlate authenticated changes to delivery limitations with process creation events on the hosting server.
Monitoring Recommendations
- Forward Revive Adserver application logs and web server logs to a centralized analytics platform for query against injection patterns.
- Alert on PHP worker processes spawning shell interpreters such as /bin/sh, bash, or python.
- Monitor administrative account activity on /www/admin/ endpoints related to delivery limitations.
How to Mitigate CVE-2026-34916
Immediate Actions Required
- Upgrade Revive Adserver to a release later than 6.0.6 that includes the improved input validation for the logical parameter.
- Audit all accounts with permission to edit delivery limitations and remove access from users who do not require it.
- Review the compiledlimitations column for anomalous content and reset suspect limitation records to known-good values.
- Rotate credentials, API keys, and session secrets that may have been exposed through arbitrary PHP execution on the ad server.
Patch Information
Revive Adserver maintainers fixed CVE-2026-34916 by adding server-side validation of the logical parameter so that only expected logical operators are accepted before the limitation expression is compiled and stored. Apply the upstream fix by upgrading past version 6.0.6. Details are referenced in the HackerOne Security Report.
Workarounds
- Restrict access to the Revive Adserver administrative interface to trusted IP ranges using web server ACLs or a reverse proxy.
- Temporarily revoke the delivery limitation editing capability from all non-administrator roles until the patch is deployed.
- Run the PHP runtime under a least-privilege account with disable_functions configured to block process execution primitives such as exec, shell_exec, system, and passthru.
# Example php.ini hardening to reduce post-exploitation impact
disable_functions = exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec
allow_url_include = Off
open_basedir = /var/www/revive:/tmp
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
