CVE-2026-25776
Code Injection in Movable Type Allows Arbitrary Perl Execution
Publication date: 2026-04-08
Last updated on: 2026-04-20
Assigner: JPCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sixapart | movable_type | to 2.14 (inc) |
| sixapart | movable_type | 9.0.5 |
| sixapart | movable_type | 9.0.6 |
| sixapart | movable_type | 9.1.0 |
| sixapart | movable_type | 9.1.0 |
| sixapart | movable_type | From 8.0.2 (inc) to 8.0.10 (exc) |
| sixapart | movable_type | From 8.8.0 (inc) to 8.8.3 (exc) |
| sixapart | movable_type | From 9.0.1 (inc) to 9.0.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-25776 is a critical code injection vulnerability in the Listing Framework of Movable Type, a content management system by Six Apart Ltd. This flaw allows an attacker to remotely execute arbitrary Perl scripts without authentication by exploiting the filter processing in the Listing Framework, which is used internally by the Admin Panel (mt.cgi) and the Data API (mt-data-api.cgi).
The vulnerability affects multiple versions of Movable Type and Movable Type Premium, including versions 6.0 and later, and older unsupported versions if the Listing Framework or Data API is enabled.
How can this vulnerability impact me? :
This vulnerability can have severe impacts as it allows remote attackers to execute arbitrary Perl code on the affected system without any authentication. This can lead to full system compromise, including unauthorized control over the server running Movable Type.
Exploitation could result in unauthorized access, data theft, data manipulation, or disruption of services. Additionally, a related SQL Injection vulnerability exists in the same framework, which can allow attackers to execute arbitrary SQL commands, further risking data integrity and confidentiality.
If the Admin Panel or Data API is accessible from the Internet, the risk of exploitation is high.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-25776 vulnerability immediately, users should restrict access to the vulnerable endpoints mt.cgi and mt-data-api.cgi to trusted IP addresses only.
Alternatively, disabling the Data API can reduce the attack surface by either removing execution permissions or deleting the mt-data-api.cgi file.
These measures are temporary and users are strongly advised to upgrade to the fixed versions of Movable Type as soon as possible.
- Restrict access to mt.cgi and mt-data-api.cgi to trusted IP addresses.
- Disable the Data API by deleting the mt-data-api.cgi file or removing its execution permissions.
- Upgrade to the latest fixed versions: Movable Type 9.0.7, 8.8.3, 8.0.10, or 9.1.1, including Premium and Advanced variants.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided context and resources do not explicitly mention the impact of CVE-2026-25776 on compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects Movable Type installations that have the Listing Framework enabled in the Admin Panel (mt.cgi) or the Data API (mt-data-api.cgi) accessible. Detection involves identifying if these components are present and accessible on your system or network.
To detect the vulnerability, you can check for the presence and accessibility of the vulnerable CGI scripts (mt.cgi and mt-data-api.cgi) on your web server. For example, you can use network scanning or HTTP requests to see if these endpoints respond.
Suggested commands include:
- Using curl or wget to check if mt.cgi or mt-data-api.cgi are accessible from your network: `curl -I http://yourserver/mt.cgi` and `curl -I http://yourserver/mt-data-api.cgi`
- Using nmap to scan for HTTP services and check for these specific paths: `nmap -p 80,443 --script http-enum yourserver` and manually verify if mt.cgi or mt-data-api.cgi are listed.
- Review your web server file system or configuration to confirm if the files mt.cgi and mt-data-api.cgi exist and are executable.
If these scripts are accessible and the Movable Type version is vulnerable (versions 9.1.0 and earlier, 9.0.6 and earlier, 8.8.2 and earlier, 8.0.9 and earlier, and corresponding Premium versions), your system is at risk.
No specific detection commands or scripts for active exploitation or vulnerability scanning are provided in the available resources.