Movable Type: SQL injection in site search
Summary
Movable Type contains an SQL injection flaw in the site search function (mt-search.cgi and mt-ftsearch.cgi). An unauthenticated attacker can run arbitrary SQL queries against the database, which the vendor says may expose unpublished data. Site search is normally reachable by visitors over the internet, so exposure depends on whether the affected scripts are publicly accessible.
Affected
- Movable Type 9.0.0 to 9.0.9
- Movable Type 8.8.0 to 8.8.5
- Movable Type 8.0.0 to 8.0.12
- Movable Type Premium 9.0.0 to 9.0.9
- Movable Type Premium 2.0 to 2.17
- Movable Type Cloud Edition 9.2.0 to 9.2.1
- Movable Type Premium Cloud Edition 9.2.0 to 9.2.1
- EOL products (for example 8.4.x, 7.x and earlier, Premium 1.x) are also affected according to JVN. No fix is available for them.
- The 9.1 series is not listed as affected. Verify with the vendor.
Fixed in
- Movable Type 9.3.0
- Movable Type 9.0.10
- Movable Type 8.8.6
- Movable Type 8.0.13
- Movable Type Premium 9.3.0, 9.0.10 and 2.18
- Fixes are released together with the fix for CVE-2026-96408.
Workaround
- CGI installations: delete mt-upgrade.cgi, mt-search.cgi and mt-ftsearch.cgi, or block web access to them.
- PSGI installations (Movable Type 6.2 and later): configure RestrictedPSGIApp upgrade, RestrictedPSGIApp new_search and RestrictedPSGIApp ft_search in mt-config.cgi (ft_search requires 6.2.4 or later).
- These measures are temporary. The vendor states that upgrading is the only complete fix.
Exploitation
- No active exploitation is known.
- No public proof of concept was found.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Inventory all Movable Type and Premium instances, including Cloud instances and sites run by agencies, and confirm the exact version.
- Update to the fixed release of the same branch, or to a later release.
- Plan a migration for EOL versions.
- Until patched, block or remove mt-search.cgi and mt-ftsearch.cgi and check whether they are reachable from the internet.
- Review web server logs for unusual search requests and check that automatic updates are enabled on Cloud instances.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- JVN#91153973 Multiple vulnerabilities in Movable Type jvn.jp
- Movable Type 9.3.0 / 9.0.10 / 8.8.6 / 8.0.13 Released movabletype.org
- Six Apart advisory (Japanese) www.sixapart.jp
- JVNDB-2026-000146 jvndb.jvn.jp
- Six Apart press release www.sixapart.jp
- Strix CVE details www.strix.ai
- Vulners VulnRichment vulners.com
- VulDB entry vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:24.
Original description (NVD)
An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.