CVE-2026-33088 is a SQL injection in the Listing Framework of Movable Type from Six Apart. NVD scores it 9.8 critical. Six Apart released Movable Type 9.0.7, 8.8.3 and 8.0.10 to fix it. Update, or restrict access to the admin panel and Data API.
What's affected
JVN lists Movable Type and Movable Type Advanced 9.1.0 and earlier in the 9.1 series, 9.0.6 and earlier, 8.8.2 and earlier, and 8.0.9 and earlier. It also lists Movable Type Premium editions, and end of support lines including all of the 5, 6 and 7 series and 8.4.x.
The advisory says the issue affects installs where the Listing Framework is enabled in the administrative console or where the Data API is available. The fixed releases are 9.0.7, 8.8.3 and 8.0.10. For other lines, check the vendor notice.
How to check if you're exposed
Check your Movable Type version in the admin console footer or in your installation files. Then check whether mt.cgi (the admin panel) and mt-data-api.cgi (the Data API) can be reached from the internet. The vendor says the issue may occur when either can be accessed from outside.
What to do now
- Upgrade to 9.0.7, 8.8.3 or 8.0.10, depending on your series.
- If you cannot upgrade yet, limit access to
mt.cgiandmt-data-api.cgito trusted IP addresses. - If you do not use the Data API, disable
mt-data-api.cgiby removing its execute permission or deleting the file. - Plan to move off end of support versions, which will not receive a normal fix.
The vendor describes the workarounds as temporary.
Why it matters
The weakness class is CWE-89. The vendor says a flaw in request handling inside the Listing Framework could allow arbitrary SQL statements. That framework is used internally by both the admin panel and the Data API, so it sits on commonly exposed paths.
The same notice covers a separate code execution flaw in filter processing, CVE-2026-25776. The record for CVE-2026-33088 does not flag it as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Does disabling the Data API fully protect me?
No. The vendor lists the admin panel and the Data API as separate paths. Restrict both, and treat that as a stopgap until you upgrade.
Sources
Last reviewed: 19 October 2026.
