{"id":"CVE-2026-117687","kind":"vulnerability","aliases":["CVE-2026-117687"],"related":[],"title":"Movable Type: crafted request runs arbitrary PHP code on server","description":"Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted request that is processed by the Dynamic Publishing, an attacker may be able to execute arbitrary PHP code on the affected product.","summary":"Movable Type's Dynamic Publishing feature has a code injection flaw. A specially crafted request can make the product execute arbitrary PHP code on the server.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Movable Type","fixed":["8.8.7","8.0.14"],"affected":"<= 8.8.6 (8.8.x); <= 8.0.13 (8.0.x); 8.4.x and 7.x (EOL)","ecosystem":"vendor"},{"name":"Movable Type Premium","fixed":["2.19"],"affected":"<= 2.18","ecosystem":"vendor"}],"ecosystems":[],"tags":["code-injection","movable-type","other","php","self-hosted","six-apart"],"not_affected_if":["default-config","movable-type-9","static-publishing"],"how_to_check":"Check your Movable Type version (admin footer or mt-check.cgi). Affected: 8.8.6 and earlier, 8.0.13 and earlier, Premium 2.18 and earlier, plus EOL 8.4.x and 7.x. Then see whether Dynamic Publishing is used (sites published dynamically through PHP) and whether the DynamicTemplateAllowPHP directive is set to 1 in mt-config.cgi. Per the Japanese release notes, with it set to 0 PHP in template output was not executed before the fix.","fix":"Upgrade to Movable Type 8.8.7 (8.8.x, incl. Advanced, and AMI), 8.0.14 (8.0.x, incl. Advanced; 8.0 went EOL 2026-11-05, patch provided exceptionally) or Movable Type Premium 2.19. Movable Type 9 is not affected. 8.4.x and 7.x are EOL and affected per JVN, with no fix listed: move to a supported version. The fix can change how Dynamic Publishing sites render.","status":"open","published_at":"2026-11-12T04:17:17+00:00","first_seen_at":"2026-11-12T04:47:08+00:00","triaged_at":"2026-11-12T04:47:44+00:00","updated_at":"2026-11-12T04:48:48+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-12T04:47:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Movable Type: crafted request runs arbitrary PHP code on server","impact":"high","summary":"Movable Type's Dynamic Publishing feature has a code injection flaw. A specially crafted request can make the product execute arbitrary PHP code on the server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["movable-type","php","six-apart"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker executes arbitrary PHP code on the server","analyst_note":"Find the Six Apart advisory or NVD detail for affected Movable Type versions, the fixed version, and any Dynamic Publishing setting that exposes the flaw.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running Movable Type with the Dynamic Publishing functionality are the ones the description names. Whether a given install is reachable depends on its configuration, which the sources do not say. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000658,"input_tokens":4527,"output_tokens":410,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Six Apart advisory or NVD detail for affected Movable Type versions, the fixed version, and any Dynamic Publishing setting that exposes the flaw.","search":"'-117687':13A,16A '-2026':12A,15A 'abl':96C 'affect':104C 'apart':35B,67C 'arbitrari':6A,56B,99C 'attack':93C 'code':8A,23B,44B,58B,71C,101C 'code-inject':22B 'contain':69C 'craft':3A,49B,83C 'cve':11A,14A 'dynam':39B,76C,90C 'execut':55B,98C 'featur':41B 'flaw':46B 'function':78C 'host':32B 'inject':24B,45B,72C 'ltd':68C 'make':52B 'may':94C 'movabl':1A,26B,36B,62C 'movable':17A,19A 'movable-typ':25B 'php':7A,29B,57B,100C 'premium':21A 'process':87C 'product':54B,105C 'provid':64C 'publish':40B,77C,91C 'request':4A,50B,84C 'run':5A 'self':31B 'self-host':30B 'send':80C 'server':10A,61B 'six':34B,66C 'six-apart':33B 'special':48B,82C 'type':2A,18A,20A,27B,37B,63C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Sites running Movable Type 8.8.6 or earlier, 8.0.13 or earlier, or Premium 2.18 or earlier with Dynamic Publishing (PHP-served pages). A crafted request can make PHP code in template processing results run on the server, through tags such as MTInclude, MTIncludeBlock, MTWidgetSet, MTWidgetManager, MTFileTemplate, the mteval modifier and error templates like 404. Movable Type 9 and sites using only static publishing can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-12T04:48:48Z","by":"analyst","doc":"https://movabletype.org/documentation/appendices/release-notes/8.0.14.html","run_id":3704},"products":{"at":"2026-11-12T04:48:48Z","by":"analyst","doc":"https://movabletype.org/documentation/appendices/release-notes/8.0.14.html","run_id":3704},"how_to_check":{"at":"2026-11-12T04:48:48Z","by":"analyst","doc":"https://movabletype.org/documentation/appendices/release-notes/8.0.14.html","run_id":3704},"who_affected":{"at":"2026-11-12T04:48:48Z","by":"analyst","doc":"https://movabletype.org/documentation/appendices/release-notes/8.0.14.html","run_id":3704}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["movabletype","movabletypepremium","type","typepremium"],"ptokens":["movable","premium","type"],"labels":["codeinjection","high","movabletype","other","php","selfhosted","sixapart"],"campaign_type":null,"search_a":"'-117687':13A,16A '-2026':12A,15A 'arbitrari':6A 'code':8A 'craft':3A 'cve':11A,14A 'movabl':1A 'movable':17A,19A 'php':7A 'premium':21A 'request':4A 'run':5A 'server':10A 'type':2A,18A,20A","search_b":"'apart':35B 'arbitrari':56B 'code':23B,44B,58B 'code-inject':22B 'craft':49B 'dynam':39B 'execut':55B 'featur':41B 'flaw':46B 'host':32B 'inject':24B,45B 'make':52B 'movabl':26B,36B 'movable-typ':25B 'php':29B,57B 'product':54B 'publish':40B 'request':50B 'self':31B 'self-host':30B 'server':61B 'six':34B 'six-apart':33B 'special':48B 'type':27B,37B","search_c":"'abl':96C 'affect':104C 'apart':67C 'arbitrari':99C 'attack':93C 'code':71C,101C 'contain':69C 'craft':83C 'dynam':76C,90C 'execut':98C 'function':78C 'inject':72C 'ltd':68C 'may':94C 'movabl':62C 'php':100C 'process':87C 'product':105C 'provid':64C 'publish':77C,91C 'request':84C 'send':80C 'six':66C 'special':82C 'type':63C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117687","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117687","severity":null,"published_at":"2026-11-12T04:17:17+00:00","modified_at":"2026-11-12T04:17:17+00:00","first_seen_at":"2026-11-12T04:47:08+00:00","fetched_at":"2026-11-12T04:47:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-117687:3704","url":"https://movabletype.org/documentation/appendices/release-notes/8.8.7.html","severity":null,"published_at":"2026-11-12T04:48:48+00:00","modified_at":"2026-11-12T04:48:48+00:00","first_seen_at":"2026-11-12T04:48:48+00:00","fetched_at":"2026-11-12T04:48:48+00:00","note":"Six Apart 8.8.7/8.0.14 release notes + JVN#11786640 give versions/fix; no exploitation or PoC reported. Release-note wording on DynamicTemplateAllowPHP differs between EN and JA, so the exposed setting value is flagged for confirmation.","cites":["https://movabletype.org/documentation/appendices/release-notes/8.8.7.html","https://movabletype.org/news/2026/11/mt-887-released.html","https://jvn.jp/en/jp/JVN11786640/","https://movabletype.org/documentation/appendices/release-notes/8.0.14.html"]}],"documents":[{"id":131953,"url":"https://movabletype.org/documentation/appendices/release-notes/8.8.7.html","title":"Movable Type 8.8.7 Release Notes","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":131954,"url":"https://movabletype.org/news/2026/11/mt-887-released.html","title":"Movable Type 8.8.7 / 8.0.14 Released","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":131955,"url":"https://jvn.jp/en/jp/JVN11786640/","title":"JVN#11786640 Movable Type vulnerable to code injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":131956,"url":"https://movabletype.org/documentation/appendices/release-notes/8.0.14.html","title":"Movable Type 8.0.14 Release Notes","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}