Code Injection Vulnerability in Movable Type by Six Apart Ltd.
CVE-2026-25776
9.3CRITICAL
What is CVE-2026-25776?
A security vulnerability in Movable Type by Six Apart Ltd. exposes users to potential code injection attacks. This issue could enable an attacker to execute arbitrary Perl scripts, posing serious risks to the integrity and confidentiality of the system. Users are advised to review and update their Movable Type installations promptly to safeguard against exploitation.
Affected Version(s)
Movable Type 9.1.0 and earlier
Movable Type 9.0.6 and earlier
Movable Type 8.8.2 and earlier
References
CVSS V4
Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
CVSS V3.0
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved