JVN#92683325: Movable Type vulnerable to OS command injection

Movable Type contains an OS command injection vulnerability in its file management system.

Impact

A user with a privilege to upload files may execute an arbitrary OS command.

Solution

Update the software
Update to the latest version of each product according to the information provided by the developer.

Products Affected

Version 5.12, 5.06, 4.37, 4.292 and earlier of the products listed below are vulnerable.

• Movable Type Open Source
• Movable Type (with Professional Pack, Community Pack)
• Movable Type Enterprise
• Movable Type Advanced
  For more information, refer to the information provided by the developer.