CVE-2026-104085 Details
Description
odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.
A command injection vulnerability has been identified in the odt2spip plugin for SPIP, affecting versions prior to 4.4.0. This vulnerability allows authenticated authors to execute arbitrary commands by uploading documents with maliciously crafted filenames through the document import form. The vulnerability arises because the plugin fails to properly sanitize filenames before using them in a command that is executed by the server. As a result, an attacker can embed shell metacharacters in the filename, which are then executed as commands during the LibreOffice conversion process, leading to remote code execution on the server.
Users are advised to upgrade to odt2spip version 4.4.0 or later, which addresses the vulnerability by properly handling filenames to prevent command injection. For those unable to upgrade immediately, it is recommended to deactivate the odt2spip plugin and restrict author permissions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://plugins.spip.net/odt2spip.html | [email protected] | ProductVendor |
| https://www.vulncheck.com/advisories/odt2spip-os-command-injection-via-document-filename | [email protected] | Advisory |
| https://www.vulncheck.com/blog/spip-odt2spip-authenticated-command-injection-rce | [email protected] | ExploitRemedyTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| odt2spip | <= 4.3.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | [email protected] |
| Oct 16, 2026 | CVE Modified | [email protected] |
| Oct 13, 2026 | New CVE Received | [email protected] |
| Oct 13, 2026 | CVE Modified | CISA-ADP |