CVE-2015-1592: Movable Type improper Storable::thaw use allows local Perl file inclusion and code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityThe flaw allows unauthenticated network-reachable code execution with a high EPSS score, though no KEV listing or known exploit tag is present.

What it is

Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro/Advanced 6.0.x before 6.0.7 do not properly use the Perl Storable::thaw function. This lets remote attackers include and execute arbitrary local Perl files, and possibly execute arbitrary code, through unspecified vectors. The flaw is an injection weakness (CWE-74) in a widely deployed publishing platform.

Impact

An attacker can cause arbitrary local Perl files to be included and executed, potentially leading to arbitrary code execution on the server. That would give control over the Movable Type application and its host data.

Attack surface

The CVSS v2 vector AV:N/AC:L/Au:N/C:P/I:P/A:P indicates the flaw is reachable over the network with no authentication and low complexity. The description does not specify the exact request path or whether any user interaction is required.

Exploitation

CVE-2015-1592 is not listed in CISA KEV and no ransomware groups are documented using it, but EPSS is high at 0.75029 (99.483rd percentile), suggesting meaningful exploitation likelihood. Reference tags are advisory and database entries only, with no public exploit tag.

What to do

• Upgrade Movable Type Pro, Open Source, and Advanced to 5.2.12 or later, and Pro/Advanced 6.0.x to 6.0.7 or later.
• Apply the Debian security update DSA-3183 for packaged installations.
• Restrict network access to Movable Type administrative and application endpoints where feasible.
• Review and harden any code paths that deserialize untrusted data with Perl Storable::thaw.

Detection

• Monitor web server and application logs for unexpected Perl file inclusion or execution errors from Movable Type.
• Alert on anomalous child processes or file writes spawned by the Movable Type web process.
• Audit Movable Type installations for versions below 5.2.12 or 6.0.7 and track remediation.
• Watch for unusual requests to Movable Type endpoints that could carry serialized data.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.