VORANT. Threat Intelligence Sign in Get the full feed

Movable Type critical code injection flaws

critical vulnerability

Six Apart's Movable Type CMS contains critical code injection and SQL injection vulnerabilities enabling arbitrary Perl code and SQL command execution.

Japan's IPA has published an advisory for critical vulnerabilities in Six Apart's Movable Type content management system. The flaws include a critical code injection vulnerability (CVE-2026-25776, CVSS 9.8) and an important SQL injection vulnerability (CVE-2026-33088, CVSS 7.3). Successful exploitation could allow attackers to execute arbitrary Perl code or SQL commands on affected systems.

The vulnerabilities affect all Movable Type versions from 5.1 through 9.1.0 across multiple product lines including standard, Advanced, and Premium editions. Systems using the listing framework in the admin interface or the Data API are particularly at risk. The vendor has confirmed that even end-of-life versions dating back to Movable Type 5.1 are vulnerable.

Six Apart urges immediate patching to the latest versions. As a temporary workaround for the Data API attack vector, administrators can delete the mt-data-api.cgi file, configure the RestrictedPSGIApp environment variable to disable data_api (MT 6.2+), or set the DataAPIScript variable to an unguessable string (MT 6.0-6.1). Organizations running Movable Type should prioritize this update given the critical severity and broad version impact.

Mentioned in this report

Vulnerabilities CVE-2026-25776CVE-2026-33088

Detection guidance

Perl CGI Process Spawning Command Interpreter (Movable Type Exploitation)

ATT&CK T1190

Detects a Perl CGI process associated with Movable Type (mt.cgi, mt-data-api.cgi) spawning a shell or scripting interpreter, consistent with exploitation of the CVE-2026-25776 code injection flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Movable Type CGI Spawning Command Interpreter
id: 9f2d21b4-ac13-52f1-bc82-ec82988dee1e
status: experimental
description: Detects a Perl process running Movable Type CGI scripts (mt.cgi, mt-data-api.cgi,
  mt-search.cgi) spawning a shell or scripting interpreter, which may indicate successful
  exploitation of the Movable Type code injection vulnerability (CVE-2026-25776) allowing
  arbitrary Perl/OS command execution.
references:
- https://www.ipa.go.jp/
author: Vorant
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \perl.exe
    ParentCommandLine|contains:
    - mt.cgi
    - mt-data-api.cgi
    - mt-search.cgi
    - mt-add-notify.cgi
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \python.exe
    - \bash.exe
    - \wscript.exe
    - \cscript.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate Movable Type plugins or maintenance scripts that intentionally shell
  out to system utilities
- Custom administrative automation invoked through the Movable Type CGI interface
level: high
tags:
- attack.t1190
- attack.execution

SQL Injection Pattern in Movable Type Data API / CGI Requests

ATT&CK T1190

Detects HTTP requests to Movable Type CGI or Data API endpoints containing common SQL injection syntax, indicative of exploitation attempts against CVE-2026-33088. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: SQL Injection Pattern Targeting Movable Type Endpoints
id: 1a7feddc-e283-5cee-8cf3-db567b2f0022
status: experimental
description: Detects reverse proxy or web server access log entries showing SQL injection
  payload patterns directed at Movable Type CGI scripts or the Data API, consistent
  with exploitation of CVE-2026-33088.
references:
- https://www.ipa.go.jp/
author: Vorant
logsource:
  category: proxy
  product: null
detection:
  selection_endpoint:
    c-uri|contains:
    - mt.cgi
    - mt-data-api.cgi
    - mt-search.cgi
  selection_sqli:
    c-uri|contains:
    - '''--'
    - UNION SELECT
    - union select
    - ''' OR ''1''=''1'
    - SLEEP(
    - sleep(
    - benchmark(
    - INFORMATION_SCHEMA
  condition: selection_endpoint and selection_sqli
falsepositives:
- Automated vulnerability scanners or penetration testing tools probing the Data API
- Legitimate queries containing the word UNION or OR in unrelated URL parameters
level: high
tags:
- attack.t1190
- attack.initial_access

Python Process Spawned by Web Server Following Movable Type Request

ATT&CK T1059.006

Detects a web server process (Apache/httpd/nginx/perl CGI handler) spawning a Python interpreter shortly after handling Movable Type CGI/Data API requests, indicating potential post-exploitation scripting activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Python Interpreter Spawned by Web Server Process
id: ae2e103f-2808-541c-90fa-d9dd2218d870
status: experimental
description: Detects a Python interpreter process being spawned by a web server or
  CGI handler process (httpd, apache2, nginx, perl), which may indicate an attacker
  used Movable Type code injection to execute a Python payload for further post-exploitation
  activity.
references:
- https://www.ipa.go.jp/
author: Vorant
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /httpd
    - /apache2
    - /nginx
    - /perl
  selection_child:
    Image|endswith:
    - /python
    - /python3
  selection_cmdline:
    CommandLine|contains:
    - -c
    - socket
    - subprocess
    - os.system
  condition: selection_parent and selection_child and selection_cmdline
falsepositives:
- Legitimate web application backends that intentionally invoke Python scripts via
  CGI for reporting or data processing
- Monitoring or health-check scripts executed by the web server user
level: medium
tags:
- attack.t1059.006
- attack.execution

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2026/20260408-jvn.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free