CVE-2022-38078

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-08-24 · updated 2026-06-17
Weakness: CWE-94

Description

Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and versions are as follows: Movable Type 7 r.5202 and earlier, Movable Type Advanced 7 r.5202 and earlier, Movable Type 6.8.6 and earlier, Movable Type Advanced 6.8.6 and earlier, Movable Type Premium 1.52 and earlier, and Movable Type Premium Advanced 1.52 and earlier. Note that all versions of Movable Type 4.0 or later including unsupported (End-of-Life, EOL) versions are also affected by this vulnerability.

Affected products

Six Apart Ltd. Movable Type: before 1.53; from 6.0.0 before 6.8.7; from 7.0.0 before 7.9.5 — fixed in 1.53, 6.8.7, 7.9.5

How to fix

Upgrade to a fixed version: Six Apart Ltd. Movable Type 1.53, 6.8.7, 7.9.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-38078 or the next vulnerability affects your stack