Movable Type releases security updates to fix critical vulnerabilities

Six Apart has released critical security updates for its Movable Type content management system to address multiple vulnerabilities. The flaws include a code injection vulnerability in the upgrade script (CVE-2026-96408) that could allow remote code execution, and an SQL injection vulnerability in the site search function (CVE-2026-103668) that could lead to unauthorized data access.

Several versions are affected, including various iterations of Movable Type 9, 9.0, 8.8, and 8.0, as well as Movable Type Premium. Older versions that have reached end-of-life (EOL) are also susceptible. Six Apart recommends that users immediately upgrade to the latest patched versions, such as 9.3.0, 9.0.10, 8.8.6, or 8.0.13.

For users unable to update immediately, mitigation steps include deleting or restricting access to specific CGI files (mt-upgrade.cgi, mt-search.cgi, and mt-ftsearch.cgi) or configuring RestrictedPSGIApp settings. Additionally, cherry-pick Inc. has released updated versions of its CheckRelease and Uploader plugins to ensure compatibility with the latest Movable Type releases.