What’s Vulnerable › Vulnerabilities

CVE-2026-104085: odt2spip < 4.4.0 OS Command Injection via Document Filename

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-29
• Weakness: CWE-78

Description

odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.

Affected products

• odt2spip: before 4.4.0 — fixed in 4.4.0

How to fix

Upgrade to a fixed version: odt2spip 4.4.0. Check the vendor advisory for mitigations.

References

• https://plugins.spip.net/odt2spip.html
• https://www.vulncheck.com/advisories/odt2spip-os-command-injection-via-document-filename
• https://www.vulncheck.com/blog/spip-odt2spip-authenticated-command-injection-rce

Get alerted when CVE-2026-104085 or the next vulnerability affects your stack