Movable Type 8.8.7 Release Notes

This version of Movable Type was released November 11, 2026.

This release includes a security fix. Six Apart recommends that you upgrade to the latest version.

Resolved issues

Security fixes and improvements

Dynamic Publishing

• Fixed an issue where PHP code contained in template processing results was executed for the following MT tags, modifiers, and error display processing, even when the Configuration Directive DynamicTemplateAllowPHP was set to 1. This fix may affect the results of publishing websites and behavior in Dynamic Publishing (CVE-2026-117687, MTC-31851)

  • MTInclude tag
  • MTIncludeBlock tag
  • MTWidgetSet tag
  • MTWidgetManager tag
  • MTFileTemplate tag
  • MTUserSessionCookieDomain tag
  • MTUserSessionCookiePath tag
  • mteval modifier
  • Dynamic Publishing error templates (such as 404)

  As an exception to this change, PHP code contained in template processing results will be executed when loaded via MTInclude, MTIncludeBlock, MTWidgetSet, or MTWidgetManager if any of the following conditions are met:

• The site’s include method is set to PHP, and ssi="1" is specified in MTInclude or MTIncludeBlock

• The Server Side Includes setting (include_with_ssi) is enabled for the target template to be loaded (for MTWidgetSet and MTWidgetManager, the settings of each loaded widget are applicable)
  PHP code written directly in templates will continue to be executed as before.
  Note: When the Configuration Directive DynamicTemplateAllowPHP was set to 0, PHP code contained in template processing results was not executed prior to this fix. However, after this fix, it will be executed if it meets the exceptions described above.

Acknowledgments

We would like to thank everyone for their contributions to this release, especially those who reported these issues and vulnerabilities. We would also like to thank JPCERT/CC and IPA for their assistance in handling the vulnerability information.

Checksums

• MT-8.8.7.zip SHA1,SHA256
• MTA-8.8.7.zip SHA1,SHA256