Movable Type: Code injection in upgrade script allows remote code execution

Summary

Movable Type, a blog and content management system, contains a code injection flaw in its upgrade script (mt-upgrade.cgi). An unauthenticated remote attacker can execute an arbitrary Perl script or SQL query on the affected system without logging in. The vendor reports that the flaw is in its core framework and that a related SQL injection in site search (CVE-2026-103668) is fixed in the same release.

Affected

• Movable Type 9.0.0 to 9.0.9
• Movable Type 8.8.0 to 8.8.5
• Movable Type 8.0.0 to 8.0.12
• Movable Type Cloud Edition 9.2.0 to 9.2.1
• Movable Type Premium 9.0.0 to 9.0.9
• Movable Type Premium 2.0 to 2.17
• Movable Type Premium Cloud Edition 9.2.0 to 9.2.1
• Per JVN, end-of-life releases (Movable Type 8.4.x, 7.x and earlier, Premium 1.x) are also affected; exact ranges for these are unknown.

Fixed in

• Movable Type 9.3.0, 9.0.10, 8.8.6, 8.0.13
• Movable Type Premium 9.3.0, 9.0.10, 2.18
• Movable Type Advanced and AMI (AWS Marketplace) editions: 9.3.0, 9.0.10, 8.8.6, 8.0.13 per vendor
• Movable Type Cloud Edition: Unknown (not stated in the sources; check with the vendor)

Workaround

• For CGI installations: block web access to mt-upgrade.cgi, mt-search.cgi and mt-ftsearch.cgi, or delete these files.
• For PSGI installations (Movable Type 6.2 and later): add RestrictedPSGIApp upgrade, RestrictedPSGIApp new_search and RestrictedPSGIApp ft_search to mt-config.cgi.
• Movable Type 6.0 and 6.1: set UpgradeScript and SearchScript to long, unpredictable values in mt-config.cgi.
• The vendor states these are temporary measures only; upgrading is the only complete fix.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact total.
• No exploitation in the wild reported in the sources reviewed; not listed in KEV at the time of research.
• No public proof-of-concept found.
• Background: an older, unrelated Movable Type upgrade script flaw (2013) has a public Metasploit module.

Our recommendation

• Inventory all Movable Type instances, including Cloud, AMI and end-of-life versions.
• Update to the fixed versions listed above as a priority, or block the three CGI scripts as an interim measure.
• Review web server logs since 7 October 2026 for requests to mt-upgrade.cgi, mt-search.cgi and mt-ftsearch.cgi.
• Check the database and website files for unexpected changes or new files.
• Replace end-of-life versions, for example Movable Type 8.0.x, which receives security support only until 5 November 2026.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• JVN#91153973 (JPCERT/CC) jvn.jp
• Movable Type 9.3.0 / 9.0.10 / 8.8.6 / 8.0.13 Released (vendor, EN) movabletype.org
• Six Apart Movable Type news (vendor, JP) www.sixapart.jp
• GitHub Advisory GHSA-9xxq-384j-m3qw github.com
• OpenCVE: CVE-2026-96408 app.opencve.io
• Vulners: CVE-2026-96408 vulners.com
• Movable Type security news (vendor) www.sixapart.jp

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:05.