Movable Type 8.0.14 Release Notes

This version of Movable Type was released November 11, 2026.

This release includes a security fix. Six Apart recommends that you upgrade to the latest version.
Note: Since the Movable Type 8.0 series has only recently reached EOL on November 5, 2026, this patched release is being provided.

Resolved issues

Security fixes and improvements

Dynamic Publishing

• Fixed an issue where PHP code contained in template processing results was executed for the following MT tags, modifiers, and error display processing, even when the Configuration Directive DynamicTemplateAllowPHP was set to 1. This fix may affect the results of publishing websites and behavior in Dynamic Publishing (CVE-2026-117687, MTC-31851)

  • MTInclude tag
  • MTIncludeBlock tag
  • MTWidgetSet tag
  • MTWidgetManager tag
  • MTFileTemplate tag
  • MTUserSessionCookieDomain tag
  • MTUserSessionCookiePath tag
  • mteval modifier
  • Dynamic Publishing error templates (such as 404)

  As an exception to this change, PHP code contained in template processing results will continue to be executed when loaded via MTInclude, MTIncludeBlock, MTWidgetSet, or MTWidgetManager if any of the following conditions are met:

• The site’s include method is set to PHP, and ssi="1" is specified in MTInclude or MTIncludeBlock.

• The Server Side Includes setting (include_with_ssi) is enabled for the target template to be loaded (for MTWidgetSet and MTWidgetManager, the settings of each loaded widget are applicable)

Acknowledgments

We would like to thank everyone for their contributions to this release, especially those who reported these issues and vulnerabilities. We would also like to thank JPCERT/CC and IPA for their assistance in handling the vulnerability information.

Checksums

• MT-8.0.14.zip SHA1,SHA256
• MTA-8.0.14.zip SHA1,SHA256