INI Format string injection in Revive Adserver 6.0.4 settings

Summary

Security advisory: REVIVE-SA-2026-001

Description

HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinations are used in a setting, the admin user console could be disabled due to a fatal PHP error.

Details

The Revive Adserver settings are stored using INI files, which support variable interpolation. Using certain character sequences, such as ${{ in a setting was causing a PHP fatal error when reading back the configuration, due to inadequate escaping in the INI file writing classes from the PEAR_Config package. Only administrators are allowed to change settings, so, in normal circumstances, the disruption would be limited.