CVE-2026-96408
CriticalCVSS 9.4Summary
A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.
Risk Assessment
An attacker could gain full control of the server, execute malicious code, steal data, or modify the database. This could lead to compromise of system integrity and confidentiality.
Recommendation
Upgrade Movable Type to a version that fixes this vulnerability immediately. Restrict access to the upgrade script and enable authentication.
Other vulnerabilities in Movable Type
See all- CVE-2026-103668High
The Site Search function in Movable Type contains an SQL injection vulnerability that may allow an unauthenticated attacker to execute arbitrary SQL queries on the affected product.
- CVE-2013-2184High
Movable Type before 5.2.6 does not properly use the Storable::thaw function, allowing remote attackers to execute arbitrary code via the comment_state parameter.
- CVE-2026-33088Critical
Movable Type by Six Apart Ltd. contains an SQL injection vulnerability that may allow an attacker to execute arbitrary SQL statements.
- CVE-2026-44392Medium
Missing authorization in Movable Type allows a user without admin privileges to perform unintended updates after signing in.
Original NVD description (English source)
A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS