AI description
CVE-2026-117687 is a code injection vulnerability identified in Movable Type, a content management system developed by Six Apart Ltd. The flaw resides within the platform's Dynamic Publishing functionality. By sending a specially crafted request that is processed by this feature, an attacker can execute arbitrary PHP code on the server hosting the affected product. The vulnerability affects several versions of the software, including Movable Type 8.8.6 and earlier, 8.0.13 and earlier, and Movable Type Premium 2.18 and earlier, as well as older unsupported versions like Movable Type 7. Movable Type 9 is not affected. To address the issue, users are advised to update to patched versions (such as 8.8.7, 8.0.14, or Premium 2.19) or configure the environment variable `DynamicTemplateAllowPHP` to `0` to prevent PHP code execution within design templates.
- Description
- Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted request that is processed by the Dynamic Publishing, an attacker may be able to execute arbitrary PHP code on the affected product.
- Source
- vultures@jpcert.or.jp
- NVD status
- Deferred
CVSS 4.0
- Type
- Secondary
- Base score
- 6.9
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- MEDIUM
CVSS 3.0
- Type
- Secondary
- Base score
- 7.3
- Impact score
- 3.4
- Exploitability score
- 3.9
- Vector string
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Severity
- HIGH
- vultures@jpcert.or.jp
- CWE-94
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
6