What is GHSA-9xxq-384j-m3qw?

GHSA-9xxq-384j-m3qw is a security advisory published by GitHub Security Advisories with Critical severity. A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an...

Which CVE IDs does GHSA-9xxq-384j-m3qw cover?

GHSA-9xxq-384j-m3qw covers the following CVE IDs: CVE-2026-96408. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9xxq-384j-m3qw?

GHSA-9xxq-384j-m3qw has a CVSS v3 base score of 9.4, published by GitHub Security Advisories.

GHSA-9xxq-384j-m3qwCriticalCVSS 9.4

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an...

Vendor

GitHub Security Advisories

Published

October 7, 2026

Last Modified

October 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-96408 →

📋 Description

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-96408
https://jvn.jp/en/jp/JVN91153973
https://movabletype.org/news/2026/10/mt-930-released.html
https://www.sixapart.jp/movabletype/news/2026/10/07-1100.html
https://github.com/advisories/GHSA-9xxq-384j-m3qw