Arbitrary file upload in Six Apart Ltd products - CVE-2026-23704

Vulnerability identifier: #VU122294

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-23704

CWE-ID: CWE-434

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload. A remote user can upload a malicious file and execute it on the server.

Movable Type Premium
Movable Type Premium (Advanced Edition)
Movable Type Premium Cloud Edition
Movable Type
Movable Type Advanced
Movable Type Cloud Edition

Install updates from vendor's website.

Movable Type Premium - addressed in versions 2.14, 9.1.0
Movable Type Premium (Advanced Edition) - addressed in versions 2.14, 9.1.0
Movable Type Premium Cloud Edition - addressed in versions 2.14, 9.1.0
Movable Type - addressed in versions 8.0.9, 8.8.2, 9.0.6
Movable Type Advanced - addressed in versions 8.0.9, 8.8.2, 9.0.6
Movable Type Cloud Edition - addressed in versions 8.8.2, 9.1.0

• https://jvn.jp/en/jp/JVN45405689/index.html

• Multiple vulnerabilities in Six Apart Movable Type