Vulnerability-Lookup

CVE-2026-24447 (GCVE-0-2026-24447)

Vulnerability from cvelistv5 – Published: 2026-02-04 07:04 – Updated: 2026-02-04 15:55

Summary

If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user's environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

CWE

CWE-1236 - Improper neutralization of formula elements in a CSV file

Assigner

jpcert

References

URL

Tags

	https://movabletype.org/news/2026/02/mt-906-relea…
	https://www.sixapart.jp/movabletype/news/2026/02/…
	https://jvn.jp/en/jp/JVN45405689/

Impacted products

Vendor

Product

Version

Six Apart Ltd.

Movable Type (Software Edition)

Affected: 9.0.4 to 9.0.5 (9.0 series)
Affected: 8.8.0 to 8.8.1 (8.8 series)
Affected: 8.0.2 to 8.0.8 (8.0 series)

Six Apart Ltd.	Movable Type Advanced (Software Edition)	Affected: 9.0.4 to 9.0.5 (9.0 series) Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series)
Six Apart Ltd.	Movable Type Premium (Software Edition)	Affected: 9.0.4 (MTP 9.0 series) Affected: 2.13 and earlier (MTP 2 series)
Six Apart Ltd.	Movable Type Premium (Advanced Edition) (Software Edition)	Affected: 9.0.4 (MTP 9.0 series) Affected: 2.13 and earlier (MTP 2 series)
Six Apart Ltd.	Movable Type (Cloud Edition)	Affected: 9.0.5 (9 series) Affected: 8.8.1 (8 series)
Six Apart Ltd.	Movable Type Premium (Cloud Edition)	Affected: 9.0.5 (9 series) Affected: 2.12 (MTP 2 series)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24447",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-04T15:55:19.585103Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-04T15:55:26.690Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Movable Type (Software Edition)",
          "vendor": "Six Apart Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.4 to 9.0.5 (9.0 series)"
            },
            {
              "status": "affected",
              "version": "8.8.0 to 8.8.1 (8.8 series)"
            },
            {
              "status": "affected",
              "version": "8.0.2 to 8.0.8 (8.0 series)"
            }
          ]
        },
        {
          "product": "Movable Type Advanced (Software Edition)",
          "vendor": "Six Apart Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.4 to 9.0.5 (9.0 series)"
            },
            {
              "status": "affected",
              "version": "8.8.0 to 8.8.1 (8.8 series)"
            },
            {
              "status": "affected",
              "version": "8.0.2 to 8.0.8 (8.0 series)"
            }
          ]
        },
        {
          "product": "Movable Type Premium (Software Edition)",
          "vendor": "Six Apart Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.4 (MTP 9.0 series)"
            },
            {
              "status": "affected",
              "version": "2.13 and earlier (MTP 2 series)"
            }
          ]
        },
        {
          "product": "Movable Type Premium (Advanced Edition) (Software Edition)",
          "vendor": "Six Apart Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.4 (MTP 9.0 series)"
            },
            {
              "status": "affected",
              "version": "2.13 and earlier (MTP 2 series)"
            }
          ]
        },
        {
          "product": "Movable Type (Cloud Edition)",
          "vendor": "Six Apart Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.5 (9 series)"
            },
            {
              "status": "affected",
              "version": "8.8.1 (8 series)"
            }
          ]
        },
        {
          "product": "Movable Type Premium (Cloud Edition)",
          "vendor": "Six Apart Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.5 (9 series)"
            },
            {
              "status": "affected",
              "version": "2.12 (MTP 2 series)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user\u0027s environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1236",
              "description": "Improper neutralization of formula elements in a CSV file",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-04T07:04:04.422Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://movabletype.org/news/2026/02/mt-906-released.html"
        },
        {
          "url": "https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN45405689/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-24447",
    "datePublished": "2026-02-04T07:04:04.422Z",
    "dateReserved": "2026-01-29T02:02:27.800Z",
    "dateUpdated": "2026-02-04T15:55:26.690Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-24447\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2026-02-04T07:16:01.560\",\"lastModified\":\"2026-02-04T16:33:44.537\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user\u0027s environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"vultures@jpcert.or.jp\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV30\":[{\"source\":\"vultures@jpcert.or.jp\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.3,\"impactScore\":3.7}]},\"weaknesses\":[{\"source\":\"vultures@jpcert.or.jp\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1236\"}]}],\"references\":[{\"url\":\"https://jvn.jp/en/jp/JVN45405689/\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://movabletype.org/news/2026/02/mt-906-released.html\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html\",\"source\":\"vultures@jpcert.or.jp\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-24447\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-04T15:55:19.585103Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-04T15:55:22.739Z\"}}], \"cna\": {\"metrics\": [{\"format\": \"CVSS\", \"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L\"}, \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 4.8, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L\"}, \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Six Apart Ltd.\", \"product\": \"Movable Type (Software Edition)\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.0.4 to 9.0.5 (9.0 series)\"}, {\"status\": \"affected\", \"version\": \"8.8.0 to 8.8.1 (8.8 series)\"}, {\"status\": \"affected\", \"version\": \"8.0.2 to 8.0.8 (8.0 series)\"}]}, {\"vendor\": \"Six Apart Ltd.\", \"product\": \"Movable Type Advanced (Software Edition)\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.0.4 to 9.0.5 (9.0 series)\"}, {\"status\": \"affected\", \"version\": \"8.8.0 to 8.8.1 (8.8 series)\"}, {\"status\": \"affected\", \"version\": \"8.0.2 to 8.0.8 (8.0 series)\"}]}, {\"vendor\": \"Six Apart Ltd.\", \"product\": \"Movable Type Premium (Software Edition)\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.0.4 (MTP 9.0 series)\"}, {\"status\": \"affected\", \"version\": \"2.13 and earlier (MTP 2 series)\"}]}, {\"vendor\": \"Six Apart Ltd.\", \"product\": \"Movable Type Premium (Advanced Edition) (Software Edition)\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.0.4 (MTP 9.0 series)\"}, {\"status\": \"affected\", \"version\": \"2.13 and earlier (MTP 2 series)\"}]}, {\"vendor\": \"Six Apart Ltd.\", \"product\": \"Movable Type (Cloud Edition)\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.0.5 (9 series)\"}, {\"status\": \"affected\", \"version\": \"8.8.1 (8 series)\"}]}, {\"vendor\": \"Six Apart Ltd.\", \"product\": \"Movable Type Premium (Cloud Edition)\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.0.5 (9 series)\"}, {\"status\": \"affected\", \"version\": \"2.12 (MTP 2 series)\"}]}], \"references\": [{\"url\": \"https://movabletype.org/news/2026/02/mt-906-released.html\"}, {\"url\": \"https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html\"}, {\"url\": \"https://jvn.jp/en/jp/JVN45405689/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user\u0027s environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en-US\", \"type\": \"CWE\", \"cweId\": \"CWE-1236\", \"description\": \"Improper neutralization of formula elements in a CSV file\"}]}], \"providerMetadata\": {\"orgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"shortName\": \"jpcert\", \"dateUpdated\": \"2026-02-04T07:04:04.422Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-24447\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-04T15:55:26.690Z\", \"dateReserved\": \"2026-01-29T02:02:27.800Z\", \"assignerOrgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"datePublished\": \"2026-02-04T07:04:04.422Z\", \"assignerShortName\": \"jpcert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-2VRW-PCJQ-FV9H

Vulnerability from github – Published: 2026-02-04 09:30 – Updated: 2026-02-04 09:30

Details

Severity ?

6.5 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.8 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-24447"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-04T07:16:01Z",
    "severity": "MODERATE"
  },
  "details": "If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user\u0027s environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.",
  "id": "GHSA-2vrw-pcjq-fv9h",
  "modified": "2026-02-04T09:30:28Z",
  "published": "2026-02-04T09:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24447"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN45405689"
    },
    {
      "type": "WEB",
      "url": "https://movabletype.org/news/2026/02/mt-906-released.html"
    },
    {
      "type": "WEB",
      "url": "https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

FKIE_CVE-2026-24447

Vulnerability from fkie_nvd - Published: 2026-02-04 07:16 - Updated: 2026-02-04 16:33

Severity ?

6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Summary

References

	URL	Tags
	vultures@jpcert.or.jp	https://jvn.jp/en/jp/JVN45405689/
	vultures@jpcert.or.jp	https://movabletype.org/news/2026/02/mt-906-released.html
	vultures@jpcert.or.jp	https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user\u0027s environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well."
    }
  ],
  "id": "CVE-2026-24447",
  "lastModified": "2026-02-04T16:33:44.537",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
          "version": "3.0"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 3.7,
        "source": "vultures@jpcert.or.jp",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "vultures@jpcert.or.jp",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-04T07:16:01.560",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://jvn.jp/en/jp/JVN45405689/"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://movabletype.org/news/2026/02/mt-906-released.html"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1236"
        }
      ],
      "source": "vultures@jpcert.or.jp",
      "type": "Primary"
    }
  ]
}

JVNDB-2026-000020

Vulnerability from jvndb - Published: 2026-02-04 16:15 - Updated:2026-02-04 16:15

Severity ?

6.5 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Summary

Multiple vulnerabilities in Movable Type

Details

Movable Type provided by Six Apart Ltd. contains multiple vulnerabilities listed below.

Stored cross-site scripting vulnerability in Edit Comment (CWE-79) - CVE-2026-21393
Stored cross-site scripting vulnerability in Export Sites (CWE-79) - CVE-2026-22875
Unrestricted upload of file with dangerous type (CWE-434) - CVE-2026-23704
Improper neutralization of formula elements in a CSV file (CWE-1236) - CVE-2026-24447

CVE-2026-21393, CVE-2026-22875 Kentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported these vulnerabilities to IPA. CVE-2026-23704, CVE-2026-24447 Six Apart Ltd. reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN. JPCERT/CC and Six Apart Ltd. coordinated under the Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN45405689/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-21393
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-22875
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-23704
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-24447
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

	Six Apart, Ltd.	Movable Type
	Six Apart, Ltd.	Movable Type Advanced
	Six Apart, Ltd.	Movable Type Premium
	Six Apart, Ltd.	Movable Type Premium (Advanced Edition)

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000020.html",
  "dc:date": "2026-02-04T16:15+09:00",
  "dcterms:issued": "2026-02-04T16:15+09:00",
  "dcterms:modified": "2026-02-04T16:15+09:00",
  "description": "Movable Type provided by Six Apart Ltd. contains multiple vulnerabilities listed below.\u003cul\u003e\u003cli\u003eStored cross-site scripting vulnerability in Edit Comment (CWE-79) - CVE-2026-21393\u003c/li\u003e\u003cli\u003eStored cross-site scripting vulnerability in Export Sites (CWE-79) - CVE-2026-22875\u003c/li\u003e\u003cli\u003eUnrestricted upload of file with dangerous type (CWE-434) - CVE-2026-23704\u003c/li\u003e\u003cli\u003eImproper neutralization of formula elements in a CSV file (CWE-1236) - CVE-2026-24447\u003c/li\u003e\u003c/ul\u003eCVE-2026-21393, CVE-2026-22875\r\nKentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported these vulnerabilities to IPA.\r\n\r\nCVE-2026-23704, CVE-2026-24447\r\nSix Apart Ltd. reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN.\r\n\r\nJPCERT/CC and Six Apart Ltd. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000020.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:sixapart:movable_type",
      "@product": "Movable Type",
      "@vendor": "Six Apart, Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:sixapart:movable_type_advanced",
      "@product": "Movable Type Advanced",
      "@vendor": "Six Apart, Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:sixapart:movable_type_premium",
      "@product": "Movable Type Premium",
      "@vendor": "Six Apart, Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:sixapart:movable_type_premium_advanced",
      "@product": "Movable Type Premium (Advanced Edition)",
      "@vendor": "Six Apart, Ltd.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "6.5",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000020",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN45405689/index.html",
      "@id": "JVN#45405689",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-21393",
      "@id": "CVE-2026-21393",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-22875",
      "@id": "CVE-2026-22875",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-23704",
      "@id": "CVE-2026-23704",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-24447",
      "@id": "CVE-2026-24447",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in Movable Type"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-24447 (GCVE-0-2026-24447)

GHSA-2VRW-PCJQ-FV9H

FKIE_CVE-2026-24447

JVNDB-2026-000020

Tags

Sightings

Nomenclature