CVE-2026-117687: Code Injection

Published Nov 12, 2026

Updated

Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted request that is processed by the Dynamic Publishing, an attacker may be able to execute arbitrary PHP code on the affected product.

Event History

Nov 12, 2026

CVE Published

via MITRE·03:03 AM

Data Sourced

via MITRE·03:03 AM

DescriptionSeverity

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

An attacker must be able to send a specially crafted request that is processed by Movable Type’s Dynamic Publishing functionality. The vulnerability is remotely exploitable and does not require privileges or user interaction according to the supplied severity vector.

What is the potential impact of successful exploitation?

Successful exploitation may allow arbitrary PHP code execution on the affected product. The supplied severity vector indicates potential low impacts to confidentiality, integrity, and availability.

CVE-2026-117687: Code Injection

Event History

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What is the potential impact of successful exploitation?