Movable Type Stored XSS/Arbitrary File Upload/CVE-2026-21393 Vulnerability Advisory

Key Information Extraction Vulnerability Overview Vulnerability ID: JVN#45405689 Affected Products: Movable Type Software and Cloud Editions, provided by Six Apart Ltd. Publication Date: 2026/02/04 Last Updated: 2026/02/04 Affected Product Versions: - Movable Type Software Edition: - Movable Type / Movable Type Advanced - 9.0.4 to 9.0.5 (9.0 series) - 8.8.0 to 8.8.1 (8.8 series) - 8.0.2 to 8.0.8 (8.0 series) - Movable Type Premium (Advanced Edition) - 9.0.4 (9.0 series) - 2.13 and earlier (2.0 series) - End-of-Life (EOL) versions affected: 7 series and 8.2 series - Movable Type Cloud Edition: - Movable Type - 9.0.5 (9.0 series) - 8.8.1 (8.8 series) - Movable Type Premium - 9.0.5 (9.0 series) - 2.12 (2 series) Vulnerability Description The following vulnerabilities are listed in Movable Type: Stored Cross-Site Scripting (XSS): - In editing comments (CWE-79) - CVSS 4.0 Base Score: 4.8 - CVSS 3.0 Base Score: 5.4 - CVE: CVE-2026-21393 - In exporting sites (CWE-79) - CVSS 4.0 Base Score: 4.8 - CVSS 3.0 Base Score: 5.4 - CVE: CVE-2026-22875 Vulnerability in Uploading Dangerous File Types: - Unrestricted file upload (CWE-434) - CVSS 4.0 Base Score: 5.1 - CVSS 3.0 Base Score: 6.5 - CVE: CVE-2026-23704 Improper Neutralization of Formula Elements in CSV Files: - Improper formula element neutralization (CWE-1236) - CVSS 4.0 Base Score: 4.8 - CVSS 3.0 Base Score: 6.5 - CVE: CVE-2026-24447 Impact Arbitrary scripts may execute in the browser of logged-in users (CVE-2026-21393, CVE-2026-22875). If a product administrator accesses malicious files, arbitrary scripts may execute in the administrator’s browser (CVE-2026-23704). If users input malformed data, victim users may download CSV files containing malformed data; when opened in the user’s environment, embedded code may be executed (CVE-2026-24447). Solution Update affected products to resolve the vulnerabilities: Movable Type Software Edition: - Movable Type / Movable Type Advanced - 9.0.6 (9.0 series) - 8.8.2 (8.8 series) - 8.0.9 (8.0 series) - Movable Type Premium (Advanced Edition) - 9.1.0 (9.0 series) - 2.14 (2.0 series) Movable Type Cloud Edition: - Movable Type - 9.1.0 (9.0 series) - 8.8.2 (8.8 series) - Movable Type Premium - 9.1.0 (9.0 series) - 2.14 (2.0 series) Vendor Status Vendor: Six Apart Ltd. Status: Affected Last Updated: 2026/02/04 Acknowledgments CVE Vulnerability Reporter: Kento Ishii (GMO Cybersecurity by Ierae). CVE Vulnerability Notification to JPCERT/CC: Six Apart Ltd.

Goal Reached Thanks to every supporter — we hit 100%!

Movable Type Stored XSS/Arbitrary File Upload/CVE-2026-21393 Vulnerability Advisory

More from this source