---
id: "CVE-2026-117687"
page: "https://infrastack.ai/live/CVE-2026-117687"
kind: "vulnerability"
aliases: ["CVE-2026-117687"]
title: "Movable Type: crafted request runs arbitrary PHP code on server"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Movable Type", "fixed": ["8.8.7", "8.0.14"], "affected": "<= 8.8.6 (8.8.x); <= 8.0.13 (8.0.x); 8.4.x and 7.x (EOL)", "ecosystem": "vendor"}, {"name": "Movable Type Premium", "fixed": ["2.19"], "affected": "<= 2.18", "ecosystem": "vendor"}]
ecosystems: []
tags: ["code-injection", "movable-type", "other", "php", "self-hosted", "six-apart"]
not_affected_if: ["default-config", "movable-type-9", "static-publishing"]
published_at: "2026-11-12T04:17:17+00:00"
first_seen_at: "2026-11-12T04:47:08+00:00"
updated_at: "2026-11-12T04:48:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117687", "first_seen_at": "2026-11-12T04:47:08+00:00"}, {"source": "analyst", "url": "https://movabletype.org/news/2026/11/mt-887-released.html", "first_seen_at": "2026-11-12T04:48:48+00:00", "cites": ["https://movabletype.org/news/2026/11/mt-887-released.html", "https://jvn.jp/en/jp/JVN11786640/", "https://movabletype.org/documentation/appendices/release-notes/8.8.7.html", "https://movabletype.org/documentation/appendices/release-notes/8.0.14.html"]}]
exploit_sources: []
---

# Movable Type: crafted request runs arbitrary PHP code on server

Link for people: https://infrastack.ai/live/CVE-2026-117687 (this .md is for agents)

Movable Type's Dynamic Publishing feature has a code injection flaw. A specially crafted request can make the product execute arbitrary PHP code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Movable Type affected <= 8.8.6 (8.8.x); <= 8.0.13 (8.0.x); 8.4.x and 7.x (EOL) fixed 8.8.7, 8.0.14
- vendor:Movable Type Premium affected <= 2.18 fixed 2.19

## How to check

Check your Movable Type version (admin footer or mt-check.cgi). Affected: 8.8.6 and earlier, 8.0.13 and earlier, Premium 2.18 and earlier, plus EOL 8.4.x and 7.x. Then see whether Dynamic Publishing is used (sites published dynamically through PHP) and whether the DynamicTemplateAllowPHP directive is set to 1 in mt-config.cgi. Per the Japanese release notes, with it set to 0 PHP in template output was not executed before the fix.

## Fix

Upgrade to Movable Type 8.8.7 (8.8.x, incl. Advanced, and AMI), 8.0.14 (8.0.x, incl. Advanced; 8.0 went EOL 2026-11-05, patch provided exceptionally) or Movable Type Premium 2.19. Movable Type 9 is not affected. 8.4.x and 7.x are EOL and affected per JVN, with no fix listed: move to a supported version. The fix can change how Dynamic Publishing sites render.

## Timeline

- 2026-11-12T04:47:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117687
- 2026-11-12T04:48:48+00:00 analyst https://movabletype.org/news/2026/11/mt-887-released.html — Six Apart 8.8.7/8.0.14 release notes + JVN#11786640 give versions/fix; no exploitation or PoC reported. Release-note wording on DynamicTemplateAllowPHP differs between EN and JA, so the exposed setting value is flagged for confirmation.

## Documents

- [advisory] Movable Type 8.8.7 / 8.0.14 Released https://movabletype.org/news/2026/11/mt-887-released.html
- [advisory] JVN#11786640 Movable Type vulnerable to code injection https://jvn.jp/en/jp/JVN11786640/
- [fix] Movable Type 8.8.7 Release Notes https://movabletype.org/documentation/appendices/release-notes/8.8.7.html
- [fix] Movable Type 8.0.14 Release Notes https://movabletype.org/documentation/appendices/release-notes/8.0.14.html

## From the sources

Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted request that is processed by the Dynamic Publishing, an attacker may be able to execute arbitrary PHP code on the affected product.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_