Administrator-session script execution via malicious file upload

Unrestricted file upload in Six Apart Movable Type affected releases allows remote authenticated users to trigger stored XSS. The entry-editing screen renders active content from a file uploaded by a non-administrative user without safely neutralizing it, so its script executes in an administrator's browser. Exploitation requires a product user to upload the file and an administrator or the product to access it; the resulting script runs with the administrator's browser session.