CVE-2026-103668: Improper neutralization of special elements used in an SQL command ('SQL Injection') in Six Apart Ltd. Movable Type Cloud Edition

This vulnerability involves improper neutralization of special elements used in an SQL command within the Site Search feature of Movable Type Cloud Edition. An unauthenticated attacker can exploit this flaw to execute arbitrary SQL queries, potentially compromising the confidentiality, integrity, and availability of the affected system. The CVSS 3.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact.

Successful exploitation can lead to unauthorized disclosure of sensitive information (high confidentiality impact), partial modification of data (low integrity impact), and partial disruption of service (low availability impact). Since the attacker does not require authentication, the risk is elevated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Site Search function if possible and monitor for suspicious activity related to SQL injection attempts.