UpHeron
All vulnerabilities

Servers and applications

CVE-2026-117687

Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted request that is processed by the Dynamic Publishing, an attacker may be able to execute arbitrary PHP code on the affected product.

Severity
High 7.3
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Weakness
Code injection (CWE-94)
Attack
Over the network · No login needed · No user action needed
Attacker can
Read some data · Change some data · Slow it down
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Sources
CVE Program

Affected software

SoftwareAffected versions
Movable TypeServers and applications · cna:six apart ltd.|movable type*
  • From 2.00 up to 2.18
  • From 8.0.0 up to 8.0.13
  • From 8.8.0 up to 8.8.6

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-117687