CVE-2009-2481: Six Apart Movable Type

Medium severity, CVSS 5.8. EPSS: 1.2% chance of exploitation in the next 30 days.

mt-wizard.cgi in Six Apart Movable Type before 4.261, when global templates are not initialized, allows remote attackers to bypass access restrictions and (1) send e-mail to arbitrary addresses or (2) obtain sensitive information via unspecified vectors.

Affected products

• Six Apart Movable Type: version 1.54 only; version 2.6 only; version 2.63 only; version 3.3 only; version 3.16 only; version 3.17 only; …
• Sixapart Movable Type: up to and including 4.26; version 1.00 only; version 1.1 only; version 1.2 only; version 1.3 only; version 1.4 only; …

Published 2009-07-16. Last modified 2026-06-16.