Description
Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script.
Published: 2026-04-08
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution via arbitrary Perl injection
Action: Patch Update
AI Analysis

Impact

Movable Type contains a code injection flaw (CWE‑94) that allows attackers to embed and run arbitrary Perl code. The vulnerability arises from insufficient validation of user‑supplied data in the blog entry processing component. Successful exploitation gives an attacker full control over the web server running the application, enabling data theft, modification, arbitrary code execution and potential lateral movement.

Affected Systems

All editions of Movable Type from Six Apart Ltd.—standard, Advanced, Premium, Premium Advanced, and the MT8‑based Premium release—are affected. No specific version numbers are enumerated; any installation lacking the latest patch may be vulnerable.

Risk and Exploitability

The flaw carries a CVSS score of 9.3, indicating a critical level of danger. An exploit probability score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector can be inferred to be remote through the web interface, requiring network access to the affected instance. Attackers would gain unrestricted control without additional privileges.

Generated by OpenCVE AI on April 8, 2026 at 11:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Movable Type release that includes the remediation for this code injection flaw, such as the patch supplied with version 907 or newer
  • Verify that the updated package has corrected the input validation around Perl execution paths
  • If an update is not immediately available, isolate the affected site from external access and monitor for unauthorized code execution attempts
  • Check the vendor’s security advisory pages for any interim mitigation guidance

Generated by OpenCVE AI on April 8, 2026 at 11:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 20 Apr 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Sixapart
Sixapart movable Type
CPEs cpe:2.3:a:sixapart:movable_type:*:*:*:*:advanced:*:*:*
cpe:2.3:a:sixapart:movable_type:*:*:*:*:premium_advanced:*:*:*
cpe:2.3:a:sixapart:movable_type:9.0.5:*:*:*:premium_advanced:*:*:*
cpe:2.3:a:sixapart:movable_type:9.0.6:*:*:*:premium_advanced:*:*:*
cpe:2.3:a:sixapart:movable_type:9.1.0:*:*:*:advanced:*:*:*
cpe:2.3:a:sixapart:movable_type:9.1.0:*:*:*:premium_advanced:*:*:*
Vendors & Products Sixapart
Sixapart movable Type

Thu, 09 Apr 2026 08:30:00 +0000

Type Values Removed Values Added
First Time appeared Six Apart
Six Apart movable Type
Six Apart movable Type Premium (mt8-based)
Six Apart movable Type Premium Advanced Edition
Vendors & Products Six Apart
Six Apart movable Type
Six Apart movable Type Premium (mt8-based)
Six Apart movable Type Premium Advanced Edition

Wed, 08 Apr 2026 20:15:00 +0000

Type Values Removed Values Added
Title Code injection in Movable Type enables arbitrary Perl execution

Wed, 08 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 08 Apr 2026 09:15:00 +0000

Type Values Removed Values Added
Description Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script.
Weaknesses CWE-94
References
Metrics cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Six Apart Movable Type Movable Type Premium (mt8-based) Movable Type Premium Advanced Edition
Sixapart Movable Type
cve-icon MITRE

Status: PUBLISHED

Assigner: jpcert

Published:

Updated: 2026-04-08T13:22:04.832Z

Reserved: 2026-03-26T01:06:12.957Z

Link: CVE-2026-25776

cve-icon Vulnrichment

Updated: 2026-04-08T13:22:01.041Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-08T09:16:20.360

Modified: 2026-04-20T17:21:58.630

Link: CVE-2026-25776

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-09T08:21:55Z

Weaknesses