CPANSA-MT-2026-96408: MT vulnerability

Publisher	giterlizzi	Document category	csaf_security_advisory
Initial release date	2026-10-07T00:00:00	Engine	CSAF Perl Toolkit 0.26
Current release date	2026-10-07T00:00:00	Build Date
Current version	1	Status	final
CVSS v3.1 Base Score	9.4	Severity
Original language		Language	en
Also referred to

Vulnerability Description

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

Vulnerabilities

CVE-2026-96408

Vulnerability Description

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

Weakness	CWE-94 : Improper Control of Generation of Code ('Code Injection')

Product status

Known affected

Product

Score

MT greater than or equal 9.2.0 and less than or equal 9.2.1

CVSS Version	CVSS Vector	CVSS Base Score	CVSS Base Severity
3.0	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L	9.4	Critical

MT greater than or equal 9.0.0 and less than or equal 9.0.9

CVSS Version	CVSS Vector	CVSS Base Score	CVSS Base Severity
3.0	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L	9.4	Critical

MT greater than or equal 8.8.0 and less than or equal 8.8.5

CVSS Version	CVSS Vector	CVSS Base Score	CVSS Base Severity
3.0	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L	9.4	Critical

MT greater than or equal 8.0.0 and less than or equal 8.0.12

CVSS Version	CVSS Vector	CVSS Base Score	CVSS Base Severity
3.0	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L	9.4	Critical

MT greater than or equal 8.4.0 and less than 8.5.0

CVSS Version	CVSS Vector	CVSS Base Score	CVSS Base Severity
3.0	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L	9.4	Critical

MT greater than or equal 7 and less than 8

CVSS Version	CVSS Vector	CVSS Base Score	CVSS Base Severity
3.0	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L	9.4	Critical

giterlizzi

Namespace: https://github.com/giterlizzi/

gdt@cpan.org

References

CPANSA-MT-2026-96408 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-mt-2026-96408.json
https://jvn.jp/en/jp/JVN91153973/ external
https://jvn.jp/en/jp/JVN91153973/
https://movabletype.org/news/2026/10/mt-930-released.html external
https://movabletype.org/news/2026/10/mt-930-released.html
https://www.sixapart.jp/movabletype/news/2026/10/07-1100.html external
https://www.sixapart.jp/movabletype/news/2026/10/07-1100.html
CVE-2026-96408 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2026-96408

Revision history

Version	Date of the revision	Summary of the revision
1	Wed Oct 7 00:00:00 2026	First release

Sharing rules

TLP:WHITE
For the TLP version see: https://www.first.org/tlp/