Movable Type CMS patched for code and SQL injection flaws
Movable Type CMS has critical code injection and SQL injection flaws allowing arbitrary Perl code and SQL command execution across all supported versions.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Japan's Information-technology Promotion Agency (IPA) disclosed two vulnerabilities in Movable Type, a content management system developed by Six Apart. The flaws include a critical code injection vulnerability (CVE-2026-25776, CVSS 9.8) and an important SQL injection vulnerability (CVE-2026-33088, CVSS 7.3). Exploitation permits attackers to execute arbitrary Perl code or SQL commands on affected systems.
The vulnerabilities impact all currently supported Movable Type versions across multiple product lines (8.x, 9.x series) including Standard, Advanced, and Premium editions. Additionally, numerous end-of-life versions (5.1 through 7.x series) remain vulnerable, particularly those using the listing framework in administrative interfaces or the Data API.
Six Apart has released patches for supported versions and recommends immediate updates. For systems that cannot be patched immediately, the vendor provides workarounds to disable the Data API attack vector by removing mt-data-api.cgi, configuring the RestrictedPSGIApp environment variable, or setting DataAPIScript to an unguessable string depending on the deployment method and version.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned from Movable Type CGI Handler
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects shell or interpreter processes spawned by Movable Type's CGI scripts (mt.cgi, mt-data-api.cgi), consistent with exploitation of the CVE-2026-25776 Perl code injection vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned from Movable Type CGI Handler
id: ade66a50-dd42-502a-8ee3-2154ec836434
status: experimental
description: Detects shell, script interpreter, or download utility processes spawned
by Movable Type CGI handlers (mt.cgi, mt-data-api.cgi, mt-search.cgi), which is
consistent with exploitation of the Movable Type Perl code injection vulnerability
(CVE-2026-25776) allowing arbitrary code execution via the web application.
references:
- Movable Type CVE-2026-25776 / CVE-2026-33088 advisory
author: Vorant
tags:
- attack.t1190
- attack.t1059.006
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /mt.cgi
- /mt-data-api.cgi
- /mt-search.cgi
- /mt-add-notify.cgi
Image|endswith:
- /sh
- /bash
- /dash
- /python
- /python3
- /perl
- /curl
- /wget
condition: selection
falsepositives:
- Custom Movable Type plugins that legitimately shell out to helper scripts or ImageMagick/convert
wrappers
- Administrative automation that invokes curl/wget from CGI wrapper scripts for legitimate
integrations
level: high
Web Shell File Written to Movable Type CGI Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a new .cgi or .pl file written into a Movable Type cgi-bin/mt directory by the web server or Perl process, indicating a possible web shell dropped via the code injection vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Shell File Written to Movable Type CGI Directory
id: b39bea8b-cbbc-55a4-8ba4-91d6d63c2798
status: experimental
description: Detects creation of a new .cgi or .pl script within a Movable Type installation's
cgi-bin or mt directory by the web server or Perl runtime, which may indicate a
web shell deployed following exploitation of the Movable Type code injection vulnerability
(CVE-2026-25776).
references:
- Movable Type CVE-2026-25776 / CVE-2026-33088 advisory
author: Vorant
tags:
- attack.t1505.003
- attack.t1190
logsource:
category: file_event
product: linux
detection:
selection:
Image|endswith:
- /httpd
- /apache2
- /nginx
- /perl
TargetFilename|contains:
- /cgi-bin/
- /mt/
TargetFilename|endswith:
- .cgi
- .pl
filter:
TargetFilename|contains:
- /mt-static/
condition: selection and not filter
falsepositives:
- Legitimate installation or upgrade of Movable Type plugins that add new .cgi/.pl
scripts
- Administrator-deployed custom CGI scripts during maintenance windows
level: high
Inline Script Execution via Interpreter Spawned by Web Server Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Python or Perl interpreters invoked with inline code execution flags (-c/-e) by a web server or CGI parent process, indicating possible arbitrary code execution through a web application vulnerability such as the Movable Type Data API code injection flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Inline Script Execution via Interpreter Spawned by Web Server Process
id: 1beab909-84c1-5dc6-a902-3365501a1842
status: experimental
description: Detects Python or Perl processes launched with an inline execution flag
(-c or -e) whose parent process is a web server or CGI handler, which is a common
post-exploitation pattern following code injection into a web application such as
Movable Type's Data API.
references:
- Movable Type CVE-2026-25776 / CVE-2026-33088 advisory
author: Vorant
tags:
- attack.t1059.006
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /mt.cgi
- /mt-data-api.cgi
Image|endswith:
- /python
- /python3
- /perl
CommandLine|contains:
- ' -c '
- ' -e '
condition: selection
falsepositives:
- Legitimate CGI wrapper scripts that invoke python/perl with -c for small helper
tasks
- Monitoring or health-check scripts executed inline by the web server
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2026/20260408-jvn.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs