CVE-2012-1497: Movabletype Movable Type Advanced

Medium severity, CVSS 4.0. EPSS: 1.8% chance of exploitation in the next 30 days.

The default configuration of Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 supports the "mt:Include file=" attribute, which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files by leveraging the template-designer role.

Affected products

• Movabletype Movable Type Advanced: up to and including 4.37; version 4.0 only; version 4.1 only; version 4.01 only; version 4.2 only; version 4.3 only; …
• Movabletype Movable Type Enterprise: up to and including 4.37; version 4.0 only; version 4.1 only; version 4.01 only; version 4.2 only; version 4.3 only; …
• Movabletype Movable Type Open Source: up to and including 4.37; version 4.0 only; version 4.1 only; version 4.01 only; version 4.2 only; version 4.3 only; …
• Movabletype Movable Type Pro: up to and including 4.37; version 4.0 only; version 4.1 only; version 4.01 only; version 4.2 only; version 4.3 only; …

Published 2012-03-03. Last modified 2026-06-16.