CVE-2026-104085: odt2spip < 4.4.0 OS Command Injection via Document Filename
odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spipdeplacerfichierupload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
odt2spip plugin for SPIPto a version that resolves this vulnerability.Fixed in 4.4.0
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be authenticated as an author and able to use the document import form.
What account context do injected commands run under?
Commands execute as the web-server user during the LibreOffice conversion process.
Which uploaded filenames are relevant to exploitation?
A maliciously crafted non-.odt filename containing shell metacharacters can reach the vulnerable conversion path.
Which versions require remediation?
odt2spip versions before 4.4.0 are affected.