SQL Injection Vulnerability in Movable Type by Six Apart
CVE-2026-103668
8.8HIGH
What is CVE-2026-103668?
An SQL Injection vulnerability has been identified in the Site Search feature of Movable Type, a web publishing platform by Six Apart. This flaw could enable unauthenticated attackers to craft and execute arbitrary SQL queries on the affected system, potentially leading to data leakage, unauthorized access, or other malicious activities. Users are encouraged to apply the latest security updates and utilize best practices to mitigate risks associated with this vulnerability.
Affected Version(s)
Movable Type 9.0.0 <= 9.0.9
Movable Type 8.8.0 <= 8.8.5
Movable Type 8.0.0 <= 8.0.12
References
CVSS V4
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
CVSS V3.0
Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved