Description (CNA)
A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the administrator's browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Six Apart Ltd. / Movable Type (Software Edition) | affected 9.0.4 to 9.0.5 (9.0 series); affected 8.8.0 to 8.8.1 (8.8 series); affected 8.0.2 to 8.0.8 (8.0 series) |
| Six Apart Ltd. / Movable Type Advanced (Software Edition) | affected 9.0.4 to 9.0.5 (9.0 series); affected 8.8.0 to 8.8.1 (8.8 series); affected 8.0.2 to 8.0.8 (8.0 series) |
| Six Apart Ltd. / Movable Type Premium (Software Edition) | affected 9.0.4 (MTP 9.0 series); affected 2.13 and earlier (MTP 2 series) |
| Six Apart Ltd. / Movable Type Premium (Advanced Edition) (Software Edition) | affected 9.0.4 (MTP 9.0 series); affected 2.13 and earlier (MTP 2 series) |
| Six Apart Ltd. / Movable Type (Cloud Edition) | affected 9.0.5 (9 series); affected 8.8.1 (8 series) |
| Six Apart Ltd. / Movable Type Premium (Cloud Edition) | affected 9.0.5 (9 series); affected 2.12 (MTP 2 series) |
CWE
CWE-434
References
- https://movabletype.org/news/2026/02/mt-906-released.html
- https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html
- https://jvn.jp/en/jp/JVN45405689/
ADP enrichment
No English description supplied.
No references supplied.