CVE-2025-53522 Other in Movable Type (Cloud Edition)
Remote unauthenticated attackers can send tampered password reset emails to compromise user accounts in Movable Type.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-53522?
CVE-2025-53522 is a medium-severity vulnerability in Six Apart Ltd. Movable Type (Cloud Edition), published on 20 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker.
Weakness: CWE-348
Which versions are affected by CVE-2025-53522?
How do I fix CVE-2025-53522?
No fix has been published for CVE-2025-53522 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-53522 being exploited?
There is no known exploitation of CVE-2025-53522 in the wild and no public exploit code.
Sources
Also known as GHSA-q3q7-94pw-4c94.