L3 · ShartedMovable Type · CMS · RCEmovable-type-dynamic-publishing

Movable Type Dynamic Publishing can execute PHP from a crafted request

An unauthenticated request can cause affected Movable Type Dynamic Publishing sites to run PHP. Six Apart released 8.8.7, 8.0.14 and Premium 2.19. Movable Type 9 is outside the advisory’s scope.

Disclosed: Nov 11, 2026; Public disclosure date
Severity: CVSS 6.9; 1 CVE tracked here
Splash zone: Movable Type 8.8 and 8.0, Premium 2.x and unsupported 8.4 and 7 sites running affected Dynamic Publishing configurations.; Movable Type · CMS · RCE
In the wild: Unknown

What happened

Affected templates can execute PHP produced by some tags, the mteval modifier or error-page processing. The request path applies to Dynamic Publishing. JVN lists Movable Type 8.8.6 and 8.0.13 and earlier in their respective branches, including Advanced, and Premium 2.18 and earlier in 2.x, including Advanced Edition. It also identifies unsupported 8.4 and 7 as affected. Neither source establishes active exploitation.

Six Apart documents include exceptions in both 8.8.7 and 8.0.14, which are also the two bases for Premium 2.19. PHP in output loaded through MTInclude, MTIncludeBlock, MTWidgetSet or MTWidgetManager may still execute when the relevant server-side include setting is enabled, or when the site’s include method is PHP and ssi="1" is used on MTInclude or MTIncludeBlock. The 8.8.7 notes specifically warn that these exceptions can now execute PHP even with DynamicTemplateAllowPHP 0. The release also preserves existing handling of PHP written directly into templates. Verify the settings and behavior on the build you deploy.

What’s in the bowl

CVE-2026-117687CVSS 6.9

PHP code injection in Dynamic Publishing

A crafted request can cause PHP execution through affected template processing. JVN assigns CVSS 4.0 6.9 and CVSS 3.0 7.3.

Fixed versions

Product	Safe from	Note
Movable Type and Advanced 8.8	`8.8.7`
Movable Type and Advanced 8.0	`8.0.14`	Exceptional fix after end of support
Movable Type Premium and Advanced Edition	`2.19`
Movable Type 8.4 and 7	No fix	End of life

Crime-scene timeline

Nov 11, 2026
Six Apart and JVN publish the vulnerability and fixed versions
Six Apart ships 8.8.7, 8.0.14 and Premium 2.19 and documents differences in PHP handling.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Six Apart security releasePrimaryConfirms all three released versions, the exceptional 8.0 fix and template behavior.
JVN coordinated disclosurePrimaryProvides affected editions, remote request prerequisite, scoring and the interim configuration recommendation.
Six Apart 8.8.7 release notesPrimaryExplains precisely which PHP include exceptions remain after the update.

Wipe guide

The wipe checklist

0 of 3 sheets used

Identify affected sites and updateInventory Movable Type and Premium versions and check which sites use Dynamic Publishing. Obtain the matching edition and build from Six Apart. For 8.4 and 7 plan migration to a supported line. The exceptional 8.0.14 fix does not restore ongoing 8.0 support.
Limit exposure while scheduling the updateWhere feasible take affected dynamic routes offline or restrict access to trusted networks. Review DynamicTemplateAllowPHP in mt-config.cgi. JVN recommends 0 to limit template PHP, but verify the version-specific include exceptions in Six Apart’s notes and apply the update.
Test templates and investigate suspicious requestsIn staging, check include and widget settings, error pages and templates that rely on PHP before restoring public traffic. Review web and PHP logs for unexpected activity around dynamic routes. If compromise is suspected, preserve logs, isolate the site and check for unexpected PHP files or processes before replacing exposed credentials.