VulnerabilityPublished 20 Aug 2025

CVE-2025-55706: Six Apart Movable Type (Software Edition) · Open Redirect

Affects Six Apart Movable Type (Software Edition)Source CVE Database V5

Not known to be exploited · CVSS 4.3 Medium.

Data as of 26 Oct 2026, 17:16 UTC

CVSS 3.0 base score

4.3Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 20 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Six Apart Ltd. Movable Type (Software Edition)	Affected >=8.0.0 <=8.0.6 >=8.4.0 <=8.4.2	Fixed in–

AI-suggested

Immediate mitigation should include updating Movable Type installations to versions beyond 8.0.6 or 8.4.2 once patches are released by Six Apart Ltd. If patches are not yet available, organizations should implement strict input validation and URL parameter sanitization on the password reset page to prevent open redirects.
Employ web application firewalls (WAFs) with rules designed to detect and block suspicious redirect parameters or unusual URL patterns associated with open redirects.
Conduct user awareness campaigns emphasizing the risks of clicking on unsolicited password reset or similar links, especially those received via email or messaging platforms.
Monitor logs for unusual redirect activities or spikes in password reset requests that could indicate exploitation attempts.
Consider implementing multi-factor authentication (MFA) to reduce the impact of credential compromise resulting from phishing.
Review and restrict the use of password reset links in communications, possibly replacing them with more secure workflows that do not rely on URL parameters for redirection.
Engage with Six Apart Ltd. support channels to obtain official patches or recommended configurations as soon as they become available.

Description

URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL.

Impact

For European organizations using Movable Type (Software Edition) within the affected versions, this vulnerability poses a moderate risk primarily through social engineering channels. Attackers could craft malicious password reset links that redirect users to phishing sites or malware-hosting domains, potentially compromising user credentials or system security indirectly. Organizations relying on Movable Type for content management or internal communications may face reputational damage, user trust erosion, and increased risk of credential compromise. While the vulnerability does not directly allow data breach or system takeover, the indirect consequences of successful phishing or malware infection can be significant, especially in sectors handling sensitive data such as finance, healthcare, and government. The requirement for user interaction means that user awareness and training are critical factors in mitigating impact. Additionally, the vulnerability could be leveraged in targeted attacks against high-value individuals or organizations within Europe.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 20 Aug 2025, 04:47 UTC

Technical details

References

Community reviews

Related threats