CVE-2021-20837

Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier ...

9.8 CriticalPublic exploit

Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors. Note that all versions of Movable Type 4.0 or later including unsupported (End-of-Life, EOL) versions are also affected by this vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

88.1%Up 84.7 points since Oct 26, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2021-20837
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-78
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-20837
Updated: 2026-11-02

EUVDEUVD-2021-8249 No score

Record: EUVD-2021-8249
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fq4q-8q83-6gj7 No score

Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier ...

Record: GHSA-fq4q-8q83-6gj7
Weakness: CWE-78
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Movable Type 7 r.5002 - XMLRPC API OS Command Injection (Metasploit)	2021-10-29
Nuclei	MovableType - Remote Command Injection
PoC in GitHub	Cosemz/CVE-2021-20837	2021-11-01
PoC in GitHub	ghost-nemesis/cve-2021-20837-poc	2021-10-25
PoC in GitHub	orangmuda/CVE-2021-20837	2021-10-30

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-20837 is a critical vulnerability (CVSS 9.8) in Six Apart Ltd. Movable Type, published October 26, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 88.1%, the 99th percentile. No source names a fixed version.