A non‑administrative user can upload any file type, and when an administrator views that file through Movable Type, the browser executes arbitrary script. This enables client‑side code execution that can steal credentials, deface content, or serve as a foothold for further attacks. The weakness is an unrestricted upload of dangerous file types (CWE‑434).

The flaw affects all editions of Movable Type supplied by Six Apart, including the Cloud Edition, Software Edition, Advanced, and Premium releases. All affected releases are in the 7 series and 8.4 series, which are already end‑of‑life. No specific patch version list is provided, but the vulnerability exists across those series.

The vulnerability carries a CVSS score of 5.1, indicating a moderate impact if successfully exploited. The EPSS score is below 1 %, suggesting very low but nonzero likelihood of exploitation in the wild. The issue is not listed in CISA’s KEV catalog. An attacker needs only a non‑administrator account to upload a malicious file; execution requires that an administrator later accesses the file, which is a predictable action in normal usage. Exploitation does not require elevated privileges on the server, but the impact arises when the administrator’s browser runs the injected script.