CVE-2026-117687 PUBLISHED

Assigner: jpcert
Reserved: 06.11.2026 Published: 12.11.2026 Updated: 12.11.2026

Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted request that is processed by the Dynamic Publishing, an attacker may be able to execute arbitrary PHP code on the affected product.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor Six Apart Ltd.
Product Movable Type
Versions Default: unaffected
  • affected from 8.8.0 to 8.8.6 (incl.)
Vendor Six Apart Ltd.
Product Movable Type Advanced
Versions Default: unaffected
  • affected from 8.8.0 to 8.8.6 (incl.)
Vendor Six Apart Ltd.
Product Movable Type
Versions Default: unaffected
  • affected from 8.0.0 to 8.0.13 (incl.)
Vendor Six Apart Ltd.
Product Movable Type Advanced
Versions Default: unaffected
  • affected from 8.0.0 to 8.0.13 (incl.)
Vendor Six Apart Ltd.
Product Movable Type Premium
Versions Default: unaffected
  • affected from 2.00 to 2.18 (incl.)
Vendor Six Apart Ltd.
Product Movable Type Premium Advanced Edition
Versions Default: unaffected
  • affected from 2.00 to 2.18 (incl.)

References

Problem Types