CVE-2026-103668Published

An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product.

cve-program · CVE-2026-103668

Published

Movable Type Cloud Edition

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Six Apart Ltd.",
                    "product": "Movable Type Cloud Edition",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "9.2.0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThanOrEqual": "9.2.1"
                        }
                    ]
                }

Movable Type

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Six Apart Ltd.",
                    "product": "Movable Type",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "9.0.0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThanOrEqual": "9.0.9"
                        },
                        {
                            "version": "8.8.0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThanOrEqual": "8.8.5"
                        },
                        {
                            "version": "8.0.0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThanOrEqual": "8.0.12"
                        }
                    ]
                }

Movable Type Premium Cloud Edition

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Six Apart Ltd.",
                    "product": "Movable Type Premium Cloud Edition",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "9.2.0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThanOrEqual": "9.2.1"
                        }
                    ]
                }

Movable Type Premium

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Six Apart Ltd.",
                    "product": "Movable Type Premium",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "9.0.0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThanOrEqual": "9.0.9"
                        },
                        {
                            "version": "2.0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThanOrEqual": "2.17"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON