Executive brief
Movable Type, a popular content management system (CMS), contains a critical security flaw in its core framework. This vulnerability allows an unauthenticated attacker to remotely execute malicious code on the server hosting the website. If exploited, an attacker could gain full control over the website, access sensitive customer data, or disrupt operations entirely.
Technical details
A code injection vulnerability (CWE-94) exists in the Listing Framework component of Movable Type, which is utilized by both the Administrative Panel (mt.cgi) and the Data API (mt-data-api.cgi). The flaw resides in the filtering process of the Listing Framework, where improper validation allows for the execution of arbitrary Perl scripts. An unauthenticated attacker can exploit this over the network if the Admin Panel or Data API is accessible from the internet. Successful exploitation results in full Remote Code Execution (RCE) with the privileges of the web server user. Patches have been released in versions 9.1.1, 9.0.7, 8.8.3, and 8.0.10. Temporary workarounds include restricting access to mt.cgi or disabling the Data API by removing mt-data-api.cgi.
Affected products
- Six Apart Ltd. Movable Type 9.1.0 and earlier, 9.0.6 and earlier, 8.8.2 and earlier, 8.0.9 and earlier, 5.1 to 8.4.4 (EOL)
- Six Apart Ltd. Movable Type Advanced 9.1.0 and earlier, 9.0.6 and earlier, 8.8.2 and earlier, 8.0.9 and earlier, 5.1 to 8.4.4 (EOL)
- Six Apart Ltd. Movable Type Premium 9.1.0 and earlier, 9.0.6 and earlier, 2.14 and earlier, 1.0 to 1.68 (EOL)
- Six Apart Ltd. Movable Type Premium Advanced Edition 9.1.0 and earlier, 9.0.6 and earlier, 2.14 and earlier
Timeline
- 2026-04-08: disclosed
- 2026-04-08: patched
- 2026-04-08: advisory