CVE-2026-117687

Description

Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted request that is processed by the Dynamic Publishing, an attacker may be able to execute arbitrary PHP code on the affected product.

OhShit! incidents

• Movable Type Dynamic Publishing can execute PHP from a crafted request →

References

• www.cve.org/CVERecord ↗
• nvd.nist.gov/vuln/detail/CVE-2026-117687 ↗
• jvn.jp/en/jp/JVN11786640/ ↗
• movabletype.org/news/2026/11/mt-887-released.html ↗
• www.sixapart.jp/movabletype/news/2026/11/11-1100.html ↗

Related CVEs

• CVE-2026-124815Clockinator LiteCVSS 10.0
• CVE-2026-124814Ultimate Addons for Elementor FormsCVSS 9.8
• CVE-2026-110959DescopeCVSS 9.8
• CVE-2026-76954Synology / DiskStation Manager (DSM)CVSS 9.8
• CVE-2026-126785rmalright / TR-VISION HOMECVSS 9.3
• CVE-2026-67449Portabase / portabaseCVSS 9.8
• CVE-2026-126263Fortinet / FortiMailCVSS 9.8
• CVE-2026-96408Six Apart Ltd. / Movable Type Cloud Edition · +3CVSS 9.3