Vulnerability-Lookup

CVE-2026-24447 (GCVE-0-2026-24447)

Vulnerability from cvelistv5 – Published: 2026-02-04 07:04 – Updated: 2026-02-04 15:55

Summary

If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user's environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-04 15:55 UTC

CWE

CWE-1236 - Improper neutralization of formula elements in a CSV file

Assigner

jpcert jpcert root

References

3 references

URL	Tags
https://movabletype.org/news/2026/02/mt-906-relea…
https://www.sixapart.jp/movabletype/news/2026/02/…
https://jvn.jp/en/jp/JVN45405689/

Impacted products

6 products

Vendor	Product	Version	CPE status
Six Apart Ltd.	Movable Type (Software Edition)	Affected: 9.0.4 to 9.0.5 (9.0 series) Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series)	guessed
Six Apart Ltd.	Movable Type Advanced (Software Edition)	Affected: 9.0.4 to 9.0.5 (9.0 series) Affected: 8.8.0 to 8.8.1 (8.8 series) Affected: 8.0.2 to 8.0.8 (8.0 series)	guessed
Six Apart Ltd.	Movable Type Premium (Software Edition)	Affected: 9.0.4 (MTP 9.0 series) Affected: 2.13 and earlier (MTP 2 series)	guessed
Six Apart Ltd.	Movable Type Premium (Advanced Edition) (Software Edition)	Affected: 9.0.4 (MTP 9.0 series) Affected: 2.13 and earlier (MTP 2 series)	guessed
Six Apart Ltd.	Movable Type (Cloud Edition)	Affected: 9.0.5 (9 series) Affected: 8.8.1 (8 series)	guessed
Six Apart Ltd.	Movable Type Premium (Cloud Edition)	Affected: 9.0.5 (9 series) Affected: 2.12 (MTP 2 series)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24447",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-04T15:55:19.585103Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-04T15:55:26.690Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Movable Type (Software Edition)",
          "vendor": "Six Apart Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.4 to 9.0.5 (9.0 series)"
            },
            {
              "status": "affected",
              "version": "8.8.0 to 8.8.1 (8.8 series)"
            },
            {
              "status": "affected",
              "version": "8.0.2 to 8.0.8 (8.0 series)"
            }
          ]
        },
        {
          "product": "Movable Type Advanced (Software Edition)",
          "vendor": "Six Apart Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.4 to 9.0.5 (9.0 series)"
            },
            {
              "status": "affected",
              "version": "8.8.0 to 8.8.1 (8.8 series)"
            },
            {
              "status": "affected",
              "version": "8.0.2 to 8.0.8 (8.0 series)"
            }
          ]
        },
        {
          "product": "Movable Type Premium (Software Edition)",
          "vendor": "Six Apart Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.4 (MTP 9.0 series)"
            },
            {
              "status": "affected",
              "version": "2.13 and earlier (MTP 2 series)"
            }
          ]
        },
        {
          "product": "Movable Type Premium (Advanced Edition) (Software Edition)",
          "vendor": "Six Apart Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.4 (MTP 9.0 series)"
            },
            {
              "status": "affected",
              "version": "2.13 and earlier (MTP 2 series)"
            }
          ]
        },
        {
          "product": "Movable Type (Cloud Edition)",
          "vendor": "Six Apart Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.5 (9 series)"
            },
            {
              "status": "affected",
              "version": "8.8.1 (8 series)"
            }
          ]
        },
        {
          "product": "Movable Type Premium (Cloud Edition)",
          "vendor": "Six Apart Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.5 (9 series)"
            },
            {
              "status": "affected",
              "version": "2.12 (MTP 2 series)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user\u0027s environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1236",
              "description": "Improper neutralization of formula elements in a CSV file",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-04T07:04:04.422Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://movabletype.org/news/2026/02/mt-906-released.html"
        },
        {
          "url": "https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN45405689/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-24447",
    "datePublished": "2026-02-04T07:04:04.422Z",
    "dateReserved": "2026-01-29T02:02:27.800Z",
    "dateUpdated": "2026-02-04T15:55:26.690Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-24447",
      "date": "2026-09-16",
      "epss": "0.00224",
      "percentile": "0.13219"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-24447\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2026-02-04T07:16:01.560\",\"lastModified\":\"2026-06-17T10:23:05.427\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user\u0027s environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.\"},{\"lang\":\"es\",\"value\":\"Si se introduce un dato malformado en el producto afectado, un archivo CSV descargado del producto afectado puede contener dicho dato malformado. Cuando un usuario v\u00edctima descarga y abre dicho archivo CSV, el c\u00f3digo incrustado puede ejecutarse en el entorno del usuario. Tenga en cuenta que las series Movable Type 7 y 8.4, que est\u00e1n al final de su vida \u00fatil (EOL), tambi\u00e9n se ven afectadas por la vulnerabilidad.\"}],\"affected\":[{\"source\":\"vultures@jpcert.or.jp\",\"affectedData\":[{\"vendor\":\"Six Apart Ltd.\",\"product\":\"Movable Type (Software Edition)\",\"versions\":[{\"version\":\"9.0.4 to 9.0.5 (9.0 series)\",\"status\":\"affected\"},{\"version\":\"8.8.0 to 8.8.1 (8.8 series)\",\"status\":\"affected\"},{\"version\":\"8.0.2 to 8.0.8 (8.0 series)\",\"status\":\"affected\"}]},{\"vendor\":\"Six Apart Ltd.\",\"product\":\"Movable Type Advanced (Software Edition)\",\"versions\":[{\"version\":\"9.0.4 to 9.0.5 (9.0 series)\",\"status\":\"affected\"},{\"version\":\"8.8.0 to 8.8.1 (8.8 series)\",\"status\":\"affected\"},{\"version\":\"8.0.2 to 8.0.8 (8.0 series)\",\"status\":\"affected\"}]},{\"vendor\":\"Six Apart Ltd.\",\"product\":\"Movable Type Premium (Software Edition)\",\"versions\":[{\"version\":\"9.0.4 (MTP 9.0 series)\",\"status\":\"affected\"},{\"version\":\"2.13 and earlier (MTP 2 series)\",\"status\":\"affected\"}]},{\"vendor\":\"Six Apart Ltd.\",\"product\":\"Movable Type Premium (Advanced Edition) (Software Edition)\",\"versions\":[{\"version\":\"9.0.4 (MTP 9.0 series)\",\"status\":\"affected\"},{\"version\":\"2.13 and earlier (MTP 2 series)\",\"status\":\"affected\"}]},{\"vendor\":\"Six Apart Ltd.\",\"product\":\"Movable Type (Cloud Edition)\",\"versions\":[{\"version\":\"9.0.5 (9 series)\",\"status\":\"affected\"},{\"version\":\"8.8.1 (8 series)\",\"status\":\"affected\"}]},{\"vendor\":\"Six Apart Ltd.\",\"product\":\"Movable Type Premium (Cloud Edition)\",\"versions\":[{\"version\":\"9.0.5 (9 series)\",\"status\":\"affected\"},{\"version\":\"2.12 (MTP 2 series)\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"vultures@jpcert.or.jp\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV30\":[{\"source\":\"vultures@jpcert.or.jp\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.3,\"impactScore\":3.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-02-04T15:55:19.585103Z\",\"id\":\"CVE-2026-24447\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"vultures@jpcert.or.jp\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1236\"}]}],\"references\":[{\"url\":\"https://jvn.jp/en/jp/JVN45405689/\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://movabletype.org/news/2026/02/mt-906-released.html\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html\",\"source\":\"vultures@jpcert.or.jp\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-02-05T07:26:25+00:00",
      "cve": "CVE-2026-24447",
      "id": "CVE-2026-24447",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2026-24447",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24447.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-24447\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-04T15:55:19.585103Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-04T15:55:22.739Z\"}}], \"cna\": {\"metrics\": [{\"format\": \"CVSS\", \"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L\"}, \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 4.8, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L\"}, \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Six Apart Ltd.\", \"product\": \"Movable Type (Software Edition)\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.0.4 to 9.0.5 (9.0 series)\"}, {\"status\": \"affected\", \"version\": \"8.8.0 to 8.8.1 (8.8 series)\"}, {\"status\": \"affected\", \"version\": \"8.0.2 to 8.0.8 (8.0 series)\"}]}, {\"vendor\": \"Six Apart Ltd.\", \"product\": \"Movable Type Advanced (Software Edition)\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.0.4 to 9.0.5 (9.0 series)\"}, {\"status\": \"affected\", \"version\": \"8.8.0 to 8.8.1 (8.8 series)\"}, {\"status\": \"affected\", \"version\": \"8.0.2 to 8.0.8 (8.0 series)\"}]}, {\"vendor\": \"Six Apart Ltd.\", \"product\": \"Movable Type Premium (Software Edition)\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.0.4 (MTP 9.0 series)\"}, {\"status\": \"affected\", \"version\": \"2.13 and earlier (MTP 2 series)\"}]}, {\"vendor\": \"Six Apart Ltd.\", \"product\": \"Movable Type Premium (Advanced Edition) (Software Edition)\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.0.4 (MTP 9.0 series)\"}, {\"status\": \"affected\", \"version\": \"2.13 and earlier (MTP 2 series)\"}]}, {\"vendor\": \"Six Apart Ltd.\", \"product\": \"Movable Type (Cloud Edition)\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.0.5 (9 series)\"}, {\"status\": \"affected\", \"version\": \"8.8.1 (8 series)\"}]}, {\"vendor\": \"Six Apart Ltd.\", \"product\": \"Movable Type Premium (Cloud Edition)\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.0.5 (9 series)\"}, {\"status\": \"affected\", \"version\": \"2.12 (MTP 2 series)\"}]}], \"references\": [{\"url\": \"https://movabletype.org/news/2026/02/mt-906-released.html\"}, {\"url\": \"https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html\"}, {\"url\": \"https://jvn.jp/en/jp/JVN45405689/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user\u0027s environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en-US\", \"type\": \"CWE\", \"cweId\": \"CWE-1236\", \"description\": \"Improper neutralization of formula elements in a CSV file\"}]}], \"providerMetadata\": {\"orgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"shortName\": \"jpcert\", \"dateUpdated\": \"2026-02-04T07:04:04.422Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-24447\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-04T15:55:26.690Z\", \"dateReserved\": \"2026-01-29T02:02:27.800Z\", \"assignerOrgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"datePublished\": \"2026-02-04T07:04:04.422Z\", \"assignerShortName\": \"jpcert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-24447

Vulnerability from fkie_nvd - Published: 2026-02-04 07:16 - Updated: 2026-06-17 10:23

Severity

6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Summary

References

	URL	Tags
	vultures@jpcert.or.jp	https://jvn.jp/en/jp/JVN45405689/
	vultures@jpcert.or.jp	https://movabletype.org/news/2026/02/mt-906-released.html
	vultures@jpcert.or.jp	https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Movable Type (Software Edition)",
          "vendor": "Six Apart Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.4 to 9.0.5 (9.0 series)"
            },
            {
              "status": "affected",
              "version": "8.8.0 to 8.8.1 (8.8 series)"
            },
            {
              "status": "affected",
              "version": "8.0.2 to 8.0.8 (8.0 series)"
            }
          ]
        },
        {
          "product": "Movable Type Advanced (Software Edition)",
          "vendor": "Six Apart Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.4 to 9.0.5 (9.0 series)"
            },
            {
              "status": "affected",
              "version": "8.8.0 to 8.8.1 (8.8 series)"
            },
            {
              "status": "affected",
              "version": "8.0.2 to 8.0.8 (8.0 series)"
            }
          ]
        },
        {
          "product": "Movable Type Premium (Software Edition)",
          "vendor": "Six Apart Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.4 (MTP 9.0 series)"
            },
            {
              "status": "affected",
              "version": "2.13 and earlier (MTP 2 series)"
            }
          ]
        },
        {
          "product": "Movable Type Premium (Advanced Edition) (Software Edition)",
          "vendor": "Six Apart Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.4 (MTP 9.0 series)"
            },
            {
              "status": "affected",
              "version": "2.13 and earlier (MTP 2 series)"
            }
          ]
        },
        {
          "product": "Movable Type (Cloud Edition)",
          "vendor": "Six Apart Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.5 (9 series)"
            },
            {
              "status": "affected",
              "version": "8.8.1 (8 series)"
            }
          ]
        },
        {
          "product": "Movable Type Premium (Cloud Edition)",
          "vendor": "Six Apart Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.5 (9 series)"
            },
            {
              "status": "affected",
              "version": "2.12 (MTP 2 series)"
            }
          ]
        }
      ],
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user\u0027s environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well."
    },
    {
      "lang": "es",
      "value": "Si se introduce un dato malformado en el producto afectado, un archivo CSV descargado del producto afectado puede contener dicho dato malformado. Cuando un usuario v\u00edctima descarga y abre dicho archivo CSV, el c\u00f3digo incrustado puede ejecutarse en el entorno del usuario. Tenga en cuenta que las series Movable Type 7 y 8.4, que est\u00e1n al final de su vida \u00fatil (EOL), tambi\u00e9n se ven afectadas por la vulnerabilidad."
    }
  ],
  "id": "CVE-2026-24447",
  "lastModified": "2026-06-17T10:23:05.427",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
          "version": "3.0"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 3.7,
        "source": "vultures@jpcert.or.jp",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "vultures@jpcert.or.jp",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-24447",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-02-04T15:55:19.585103Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-02-04T07:16:01.560",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://jvn.jp/en/jp/JVN45405689/"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://movabletype.org/news/2026/02/mt-906-released.html"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1236"
        }
      ],
      "source": "vultures@jpcert.or.jp",
      "type": "Secondary"
    }
  ]
}

GHSA-2VRW-PCJQ-FV9H

Vulnerability from github – Published: 2026-02-04 09:30 – Updated: 2026-02-04 09:30

Details

Severity

6.5 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.8 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-24447"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-04T07:16:01Z",
    "severity": "MODERATE"
  },
  "details": "If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user\u0027s environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.",
  "id": "GHSA-2vrw-pcjq-fv9h",
  "modified": "2026-02-04T09:30:28Z",
  "published": "2026-02-04T09:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24447"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN45405689"
    },
    {
      "type": "WEB",
      "url": "https://movabletype.org/news/2026/02/mt-906-released.html"
    },
    {
      "type": "WEB",
      "url": "https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

JVNDB-2026-000020

Vulnerability from jvndb - Published: 2026-02-04 07:15 - Updated:2026-02-04 07:15

Severity

6.5 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Summary

Multiple vulnerabilities in Movable Type

Details

Movable Type provided by Six Apart Ltd. contains multiple vulnerabilities listed below.

Stored cross-site scripting vulnerability in Edit Comment (CWE-79) - CVE-2026-21393
Stored cross-site scripting vulnerability in Export Sites (CWE-79) - CVE-2026-22875
Unrestricted upload of file with dangerous type (CWE-434) - CVE-2026-23704
Improper neutralization of formula elements in a CSV file (CWE-1236) - CVE-2026-24447

CVE-2026-21393, CVE-2026-22875 Kentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported these vulnerabilities to IPA. CVE-2026-23704, CVE-2026-24447 Six Apart Ltd. reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN. JPCERT/CC and Six Apart Ltd. coordinated under the Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN45405689/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-21393
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-22875
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-23704
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-24447
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

	Six Apart, Ltd.	Movable Type
	Six Apart, Ltd.	Movable Type Advanced
	Six Apart, Ltd.	Movable Type Premium
	Six Apart, Ltd.	Movable Type Premium (Advanced Edition)

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000020.html",
  "dc:date": "2026-02-04T16:15+09:00",
  "dcterms:issued": "2026-02-04T16:15+09:00",
  "dcterms:modified": "2026-02-04T16:15+09:00",
  "description": "Movable Type provided by Six Apart Ltd. contains multiple vulnerabilities listed below.\u003cul\u003e\u003cli\u003eStored cross-site scripting vulnerability in Edit Comment (CWE-79) - CVE-2026-21393\u003c/li\u003e\u003cli\u003eStored cross-site scripting vulnerability in Export Sites (CWE-79) - CVE-2026-22875\u003c/li\u003e\u003cli\u003eUnrestricted upload of file with dangerous type (CWE-434) - CVE-2026-23704\u003c/li\u003e\u003cli\u003eImproper neutralization of formula elements in a CSV file (CWE-1236) - CVE-2026-24447\u003c/li\u003e\u003c/ul\u003eCVE-2026-21393, CVE-2026-22875\r\nKentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported these vulnerabilities to IPA.\r\n\r\nCVE-2026-23704, CVE-2026-24447\r\nSix Apart Ltd. reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN.\r\n\r\nJPCERT/CC and Six Apart Ltd. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000020.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:sixapart:movable_type",
      "@product": "Movable Type",
      "@vendor": "Six Apart, Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:sixapart:movable_type_advanced",
      "@product": "Movable Type Advanced",
      "@vendor": "Six Apart, Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:sixapart:movable_type_premium",
      "@product": "Movable Type Premium",
      "@vendor": "Six Apart, Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:sixapart:movable_type_premium_advanced",
      "@product": "Movable Type Premium (Advanced Edition)",
      "@vendor": "Six Apart, Ltd.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "6.5",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000020",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN45405689/index.html",
      "@id": "JVN#45405689",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-21393",
      "@id": "CVE-2026-21393",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-22875",
      "@id": "CVE-2026-22875",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-23704",
      "@id": "CVE-2026-23704",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-24447",
      "@id": "CVE-2026-24447",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in Movable Type"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-24447 (GCVE-0-2026-24447)

FKIE_CVE-2026-24447

GHSA-2VRW-PCJQ-FV9H

JVNDB-2026-000020

Tags

Sightings

Nomenclature

Related by attack behaviour