CVE-2025-54856

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-23

Last updated on: 2025-10-27

Assigner: JPCERT/CC

Description

Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-23

Last Modified

2025-10-27

Generated

2026-07-07

AI Q&A

2025-10-23

EPSS Evaluated

2026-07-05

NVD

CVE-2025-54856

EUVD

EUVD-2025-35656

Affected Vendors & Products

Vendor	Product	Version / Range
six_apart	movable_type	8.8.0
six_apart	movable_type_premium	2.11
six_apart	movable_type_premium	1.68
six_apart	movable_type_cloud	7_r.5510
six_apart	movable_type	7_r.5510
six_apart	movable_type_cloud	8.8.0
six_apart	movable_type	8.4.4
six_apart	movable_type	8.0.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2025-54856 is a stored cross-site scripting (XSS) vulnerability in Movable Type software, specifically in the Edit ContentData page. An attacker who has the "ContentType Management" privilege can store crafted input containing malicious scripts. When another user with access to the Edit ContentData page views this input, the malicious script executes in their web browser, potentially compromising their session or data. [2, 3]

Impact Analysis

This vulnerability allows an attacker with elevated privileges to inject malicious scripts that execute in the browsers of users who access the Edit ContentData page. This can lead to loss of confidentiality and integrity of data, as the attacker could potentially steal sensitive information or manipulate content viewed by legitimate users. [2]

Mitigation Strategies

To mitigate CVE-2025-54856, immediately update your Movable Type installation to one of the fixed versions released by Six Apart Ltd. These include Movable Type Software Edition versions 7 r.5510, 8.0.8, 8.4.4, and 8.8.0; Movable Type Premium versions 1.68 and 2.11; and Movable Type Cloud Edition versions 7 r.5510, 1.68, 2.11, and 8.8.0. It is recommended to back up your database before applying updates and preferably install updates in a new directory rather than overwriting existing installations. Applying these updates will fix the stored cross-site scripting vulnerability in the Edit ContentData page and prevent malicious script injection. [1, 2, 3]

Hi! I’m here to help you understand CVE-2025-54856. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70