MOVABLE TYPE · CVE-2026-117687 · Other
FIX → 8.8.7 · 2.19 +1 ✓ verified
Movable Type's Dynamic Publishing feature has a code injection flaw. A specially crafted request can make the product execute arbitrary PHP code on the server.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running Movable Type 8.8.6 or earlier, 8.0.13 or earlier, or Premium 2.18 or earlier with Dynamic Publishing (PHP-served pages). A crafted request can make PHP code in template processing results run on the server, through tags such as MTInclude, MTIncludeBlock, MTWidgetSet, MTWidgetManager, MTFileTemplate, the mteval modifier and error templates like 404. Movable Type 9 and sites using only static publishing can skip it.
Not affected if default-config, movable-type-9, static-publishing
Who cares code-injection, movable-type, php, self-hosted, six-apart
8.8.6 and earlier, 8.0.13 and earlier, Premium 2.18 and earlier, plus EOL 8.4.x and 7.xMovable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted request that is processed by the Dynamic Publishing, an attacker may be able to execute arbitrary PHP code on the affected product.
This page as ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 8.8.7 · 2.19 +1
8.8.7 (8.8.x, incl8.0.14 (8.0.x, inclNVD data is provided by NIST and is public domain. Posts quoted belong to their authors.