Skip to content
OpenAdvisories
High · 7.3 CVE-2026-33088 EUVD-2026-20133

Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL sta…

Published Apr 8, 2026 · Updated Apr 8, 2026 · Assigned by jpcert

Vendor: Six Apart Product: Movable Type Product: Movable Type Advanced Product: Movable Type Premium Product: Movable Type Premium (MT8-based) Product: Movable Type Premium Advanced Edition

Description

Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement.

Affected products

VendorProductAffectedFixed
Six Apart Movable Type 9.1.0 and earlier, 9.0.6 and earlier, 8.8.2 and earlier, 8.0.9 and earlier, 5.1 to 5.18, 5.2, 5.2.1 to 5.2.13, 6.0, 6.0.1 to 6.8.8, 7 r.4207 to r.5510, 8.4.0 to 8.4.4, 1.0 to 1.68 —
Six Apart Movable Type Advanced 9.1.0 and earlier, 9.0.6 and earlier, 8.8.2 and earlier, 8.0.9 and earlier —
Six Apart Movable Type Premium 9.1.0 and earlier, 9.0.6 and earlier, 2.14 and earlier —
Six Apart Movable Type Premium Advanced Edition 9.1.0 and earlier, 9.0.6 and earlier, 2.14 and earlier —
Six Apart Movable Type Premium (MT8-based) 2.14 and earlier —

References