Published:2026/11/11  Last Updated:2026/11/11

JVN#11786640
Movable Type vulnerable to code injection

Overview

Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality.

Products Affected

  • Movable Type
    • 8.8.6 and earlier (8.8.x series, including Advanced)
    • 8.0.13 and earlier (8.0.x series, including Advanced)
  • Movable Type Premium 2.18 and earlier (2.x series, including Advanced Edition)
This vulnerability affects Movable Type 8.4.x and 7.x series (including Advanced), which have reached End-of-Life (EOL). Movable Type 9 is not affected.

Description

Movable Type provided by Six Apart Ltd. contains the following vulnerability in its Dynamic Publishing functionality.

  • Code injection (CWE-94)
    • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N Base Score 6.9
    • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Base Score 7.3
    • CVE-2026-117687

Impact

By sending a specially crafted request that is processed by the Dynamic Publishing, an attacker may be able to execute arbitrary PHP code on the affected product.

Solution

Update the Software
Update the affected product to the latest version according to the information provided by the developer.
The following versions have been released to address the vulnerability:

  • Movable Type
    • 8.8.7 (For 8.8.x series, including Advanced)
    • 8.0.14 (For 8.0.x series, including Advanced)
  • Movable Type Premium 2.19 (For 2.x series, including Advanced Edition)
To prevent the execution of PHP code embedded in design templates, the developer recommends setting the DynamicTemplateAllowPHP environment variable to 0.

Vendor Status

Vendor Status Last Update Vendor Notes
Six Apart Ltd. Vulnerable 2026/11/11 Six Apart Ltd. website

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Six Apart Ltd. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Six Apart Ltd. coordinated under the Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2026-117687
JVN iPedia