Code Injection Vulnerability in Movable Type by Six Apart
CVE-2026-96408
9.3CRITICAL
What is CVE-2026-96408?
A code injection vulnerability has been identified in the upgrade script of Movable Type, enabling potential exploitation by unauthenticated attackers. This flaw allows unauthorized execution of arbitrary Perl scripts or SQL queries, posing significant risks to the integrity and security of the affected systems. Users are strongly advised to apply available updates and implement security measures to mitigate potential threats.
Affected Version(s)
Movable Type 9.0.0 <= 9.0.9
Movable Type 8.8.0 <= 8.8.5
Movable Type 8.0.0 <= 8.0.12
References
CVSS V4
Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
CVSS V3.0
Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved