Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.1
CVE-2026-23704: Movable Type allows malicious file uploads, risking admin browser hijacking
CVE-2026-23704 · published 9 months ago
Summary
Non-admin users can upload malicious files that can execute scripts on an administrator's browser when accessed. Affected versions of Movable Type, especially older ones, require immediate update or patching to prevent this attack. Users should check their software versions and apply the necessary security fix.
Original advisory text
A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the administrator's browser. Note that Movable ...
A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the administrator's browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-434Unrestricted File Upload
Timeline
Published4 Feb 2026
Updated31 Oct 2026
First seen7 Mar 2026
Sources
CVE-2026-23704 · NVD
Track software like this
Free during beta