Code Injection Vulnerability in Movable Type by Six Apart Ltd.
CVE-2026-117687
6.9MEDIUM
What is CVE-2026-117687?
Movable Type, a content management system developed by Six Apart Ltd., has a vulnerability within its Dynamic Publishing feature that allows code injection. Attackers can exploit this security flaw by sending specially crafted requests, potentially leading to the execution of arbitrary PHP code on the server. This could compromise the integrity of the application and allow unauthorized access to sensitive information, necessitating immediate attention and remediation.
Affected Version(s)
Movable Type 8.8.0 <= 8.8.6
Movable Type 8.0.0 <= 8.0.13
Movable Type Advanced 8.8.0 <= 8.8.6
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
CVSS V3.0
Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved