CVE-2026-96408
A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbit
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: yes
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.
Affected versions
- Six Apart Ltd. Movable Type Cloud Edition
From 9.2.0 · through 9.2.1
- Six Apart Ltd. Movable Type
From 9.0.0 · through 9.0.9; From 8.8.0 · through 8.8.5; From 8.0.0 · through 8.0.12
- Six Apart Ltd. Movable Type Premium Cloud Edition
From 9.2.0 · through 9.2.1
- Six Apart Ltd. Movable Type Premium
From 9.0.0 · through 9.0.9; From 2.0 · through 2.17