Movable Type vulnerabilities

3 known vulnerabilities in Movable Type from Six Apart. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.3 Critical severity

  Movable Type Cloud Edition: Improper Control of Generation of Code

  CVE-2026-96408Oct 7, 2026Six Apart

  A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

• 8.8 High severity

  Movable Type Cloud Edition: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-103668Oct 7, 2026Six Apart

  An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product.

• 7.2 High severity

  Movable Type: Improper Control of Generation of Code

  CVE-2022-43660Dec 7, 2022Six ApartEPSS 1.06%

  Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage of Content Types' may execute an arbitrary Perl script and/or an arbitrary OS command. Affected prod