CVE-2025-62499: Movable Type Stored XSS Vulnerability

CVE-2025-62499 Overview

CVE-2025-62499 is a stored cross-site scripting (XSS) vulnerability in Movable Type, a widely deployed content management system (CMS) developed by Six Apart. The flaw resides in the Edit CategorySet screen of the ContentType page. An authenticated attacker holding the ContentType Management privilege can persist crafted input that executes arbitrary JavaScript in the browser of any user who subsequently opens that page. The issue is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation. Six Apart addressed the flaw in Movable Type 8.8.0, published in October 2025.

Critical Impact

An authenticated administrator with ContentType Management rights can inject script that runs in other administrators' browsers, enabling session theft, privileged action forgery, and CMS content tampering.

Affected Products

• Movable Type (versions prior to 8.8.0)
• Movable Type Advanced (versions prior to 8.8.0)
• Movable Type Cloud Edition (versions prior to 8.8.0)

Discovery Timeline

• 2025-10-23 - CVE-2025-62499 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62499

Vulnerability Analysis

The vulnerability is a stored (persistent) cross-site scripting flaw located within the ContentType administration workflow of Movable Type. Specifically, the Edit CategorySet interface associated with ContentType configuration accepts input that is later rendered back into the administrator UI without adequate output encoding. Because the payload persists in the application datastore, every subsequent visitor to the affected Edit CategorySet page triggers execution in their own browser session. Successful exploitation allows the attacker to run arbitrary JavaScript in the authenticated context of the victim, which typically holds administrative privileges within Movable Type. Potential outcomes include theft of session cookies, forging of privileged CMS operations, injection of malicious content into published sites, and pivoting to further account takeover.

Root Cause

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79). Values submitted to the CategorySet editor are stored and later reflected into the ContentType administrative view without HTML entity encoding or contextual escaping. As a result, HTML and script tokens in stored data are interpreted as markup rather than literal text when the page renders.

Attack Vector

Exploitation requires an attacker who already possesses the ContentType Management privilege within a target Movable Type instance and user interaction from a victim who opens the Edit CategorySet screen. The attack is network-reachable through the CMS administration interface. Because the payload is stored server-side, delivery does not require crafted links or social engineering beyond convincing another administrator to visit an ordinarily trusted internal page. Refer to the JVN Security Advisory JVN24333679 and the Movable Type 8.8.0 Release Notes for vendor-supplied technical details.

Detection Methods for CVE-2025-62499

Indicators of Compromise

• Unexpected <script>, onerror, onload, or javascript: tokens stored in ContentType or CategorySet database records.
• Administrator sessions performing anomalous CMS API calls immediately after opening the Edit CategorySet page.
• New or modified user accounts, permissions, or ContentType definitions that do not correlate with change-management records.

Detection Strategies

• Review Movable Type application and web server access logs for POST requests to ContentType and CategorySet edit endpoints originating from accounts with ContentType Management privilege.
• Query the underlying database for CategorySet fields containing HTML tags, event handler attributes, or encoded script payloads.
• Correlate administrative page loads with outbound requests to unfamiliar domains that could indicate cookie exfiltration.

Monitoring Recommendations

• Enable and centralize Movable Type audit logging, forwarding events to a SIEM for retention and correlation.
• Alert on privilege changes, ContentType schema edits, and creation of new administrator accounts.
• Monitor browser-side Content Security Policy (CSP) violation reports from the CMS admin origin.

How to Mitigate CVE-2025-62499

Immediate Actions Required

• Upgrade Movable Type, Movable Type Advanced, and Movable Type Cloud Edition to version 8.8.0 or later.
• Audit the ContentType Management privilege assignment and revoke it from any account that does not require it.
• Inspect existing ContentType and CategorySet records for stored HTML or script content and sanitize identified entries.

Patch Information

Six Apart released Movable Type 8.8.0 to remediate CVE-2025-62499. Administrators should follow the upgrade guidance in the Movable Type 8.8.0 Release Notes and the vendor update notice from Six Apart. Verify installation success by confirming the reported version in the CMS admin footer after upgrade.

Workarounds

• Restrict access to the Movable Type administration interface to trusted networks or VPN-only reachability until patching is complete.
• Apply a strict Content Security Policy on the CMS admin origin to block inline script execution.
• Require multi-factor authentication for all accounts with content or system management privileges to raise the bar for attacker foothold.

# Example CSP header for the Movable Type admin origin (adjust to environment)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";