CVE-2026-25776

CriticalCVSS 9.3/10Last modified Jul 25, 2026

Description

Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script.

Metrics

CVSS 4.0 9.3/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-94

Affected software

VendorProductVersions
Six Apart Ltd.Movable Type9.1.0 and earlier
Six Apart Ltd.Movable Type9.0.6 and earlier
Six Apart Ltd.Movable Type8.8.2 and earlier
Six Apart Ltd.Movable Type8.0.9 and earlier
Six Apart Ltd.Movable Type Advanced9.1.0 and earlier
Six Apart Ltd.Movable Type Advanced9.0.6 and earlier
Six Apart Ltd.Movable Type Advanced8.8.2 and earlier
Six Apart Ltd.Movable Type Advanced8.0.9 and earlier
Six Apart Ltd.Movable Type Premium9.1.0 and earlier
Six Apart Ltd.Movable Type Premium9.0.6 and earlier
Six Apart Ltd.Movable Type Premium Advanced Edition9.1.0 and earlier
Six Apart Ltd.Movable Type Premium Advanced Edition9.0.6 and earlier
Six Apart Ltd.Movable Type Premium2.14 and earlier
Six Apart Ltd.Movable Type Premium Advanced Edition2.14 and earlier
Six Apart Ltd.Movable Type Premium (MT8-based)2.14 and earlier
Six Apart Ltd.Movable Type5.1 to 5.18
Six Apart Ltd.Movable Type5.2; 5.2.1 to 5.2.13
Six Apart Ltd.Movable Type6.0; 6.0.1 to 6.8.8
Six Apart Ltd.Movable Type7 r.4207 to r.5510
Six Apart Ltd.Movable Type8.4.0 to 8.4.4
Six Apart Ltd.Movable Type1.0 to 1.68

References

Timeline

Published
Apr 8, 2026
Last modified
Jul 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-257787.5The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the CVE-2026-257796.1Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values.CVE-2026-25784.3Mattermost versions 11.3.x <= 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion which allows channel members CVE-2026-257804.3Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing DOC files which CVE-2026-257818.4in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS and it cannot be recovered.CVE-2026-257825.3Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deCVE-2026-257834.3Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows CVE-2026-257849.8Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows prCVE-2026-257859.3Path traversal vulnerability exists in Lanscope Endpoint Manager (On-Premises) Sub-Manager Server Ver.9.4.7.3 and earlier, which may allow aCVE-2026-257869.1Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interfaceCVE-2026-257879.1Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the CVE-2026-257897.1Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social
CVE-2026-25776: Critical severity, CVSS 9.3 | Vulnix