VORANT. Threat Intelligence Sign in Get the full feed

Movable Type CMS has critical code injection and SQL injection flaws allowing arbitrary…

critical vulnerability

Movable Type CMS has critical code injection and SQL injection flaws allowing arbitrary Perl code and SQL command execution across all supported versions.

Japan's Information-technology Promotion Agency (IPA) disclosed two vulnerabilities in Movable Type, a content management system developed by Six Apart. The flaws include a critical code injection vulnerability (CVE-2026-25776, CVSS 9.8) and an important SQL injection vulnerability (CVE-2026-33088, CVSS 7.3). Exploitation permits attackers to execute arbitrary Perl code or SQL commands on affected systems.

The vulnerabilities impact all currently supported Movable Type versions across multiple product lines (8.x, 9.x series) including Standard, Advanced, and Premium editions. Additionally, numerous end-of-life versions (5.1 through 7.x series) remain vulnerable, particularly those using the listing framework in administrative interfaces or the Data API.

Six Apart has released patches for supported versions and recommends immediate updates. For systems that cannot be patched immediately, the vendor provides workarounds to disable the Data API attack vector by removing mt-data-api.cgi, configuring the RestrictedPSGIApp environment variable, or setting DataAPIScript to an unguessable string depending on the deployment method and version.

Mentioned in this report

Vulnerabilities CVE-2026-25776CVE-2026-33088

Detection guidance

Suspicious Child Process Spawned from Movable Type CGI Handler

ATT&CK T1190

Detects shell or interpreter processes spawned by Movable Type's CGI scripts (mt.cgi, mt-data-api.cgi), consistent with exploitation of the CVE-2026-25776 Perl code injection vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process Spawned from Movable Type CGI Handler
id: ade66a50-dd42-502a-8ee3-2154ec836434
status: experimental
description: Detects shell, script interpreter, or download utility processes spawned
  by Movable Type CGI handlers (mt.cgi, mt-data-api.cgi, mt-search.cgi), which is
  consistent with exploitation of the Movable Type Perl code injection vulnerability
  (CVE-2026-25776) allowing arbitrary code execution via the web application.
references:
- Movable Type CVE-2026-25776 / CVE-2026-33088 advisory
author: Vorant
tags:
- attack.t1190
- attack.t1059.006
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /mt.cgi
    - /mt-data-api.cgi
    - /mt-search.cgi
    - /mt-add-notify.cgi
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /python
    - /python3
    - /perl
    - /curl
    - /wget
  condition: selection
falsepositives:
- Custom Movable Type plugins that legitimately shell out to helper scripts or ImageMagick/convert
  wrappers
- Administrative automation that invokes curl/wget from CGI wrapper scripts for legitimate
  integrations
level: high

Web Shell File Written to Movable Type CGI Directory

ATT&CK T1505.003

Detects a new .cgi or .pl file written into a Movable Type cgi-bin/mt directory by the web server or Perl process, indicating a possible web shell dropped via the code injection vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Shell File Written to Movable Type CGI Directory
id: b39bea8b-cbbc-55a4-8ba4-91d6d63c2798
status: experimental
description: Detects creation of a new .cgi or .pl script within a Movable Type installation's
  cgi-bin or mt directory by the web server or Perl runtime, which may indicate a
  web shell deployed following exploitation of the Movable Type code injection vulnerability
  (CVE-2026-25776).
references:
- Movable Type CVE-2026-25776 / CVE-2026-33088 advisory
author: Vorant
tags:
- attack.t1505.003
- attack.t1190
logsource:
  category: file_event
  product: linux
detection:
  selection:
    Image|endswith:
    - /httpd
    - /apache2
    - /nginx
    - /perl
    TargetFilename|contains:
    - /cgi-bin/
    - /mt/
    TargetFilename|endswith:
    - .cgi
    - .pl
  filter:
    TargetFilename|contains:
    - /mt-static/
  condition: selection and not filter
falsepositives:
- Legitimate installation or upgrade of Movable Type plugins that add new .cgi/.pl
  scripts
- Administrator-deployed custom CGI scripts during maintenance windows
level: high

Inline Script Execution via Interpreter Spawned by Web Server Process

ATT&CK T1059.006

Detects Python or Perl interpreters invoked with inline code execution flags (-c/-e) by a web server or CGI parent process, indicating possible arbitrary code execution through a web application vulnerability such as the Movable Type Data API code injection flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Inline Script Execution via Interpreter Spawned by Web Server Process
id: 1beab909-84c1-5dc6-a902-3365501a1842
status: experimental
description: Detects Python or Perl processes launched with an inline execution flag
  (-c or -e) whose parent process is a web server or CGI handler, which is a common
  post-exploitation pattern following code injection into a web application such as
  Movable Type's Data API.
references:
- Movable Type CVE-2026-25776 / CVE-2026-33088 advisory
author: Vorant
tags:
- attack.t1059.006
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /httpd
    - /apache2
    - /nginx
    - /mt.cgi
    - /mt-data-api.cgi
    Image|endswith:
    - /python
    - /python3
    - /perl
    CommandLine|contains:
    - ' -c '
    - ' -e '
  condition: selection
falsepositives:
- Legitimate CGI wrapper scripts that invoke python/perl with -c for small helper
  tasks
- Monitoring or health-check scripts executed inline by the web server
level: medium

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2026/20260408-jvn.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free