OS Command Injection Vulnerability in odt2spip Plugin for SPIP
CVE-2026-104085

8.7HIGH

Key Information:

Vendor

Odt2spip

Status
Odt2spip
Vendor
CVE Published:
13 October 2026

What is CVE-2026-104085?

The odt2spip plugin for SPIP prior to version 4.4.0 is affected by an OS command injection vulnerability. Authenticated authors may exploit this flaw by uploading documents with specially crafted filenames, containing shell metacharacters. Inadequate sanitization in key processing functions allows these crafted filenames to be executed as commands during the LibreOffice document conversion process, potentially leading to remote code execution under the privileges of the web server. This vulnerability underscores the critical need for secure handling of user inputs and filenames in web applications.

Affected Version(s)

odt2spip 0 <= 4.4.0

References

https://plugins.spip.net/odt2spip.html
productpatch
https://www.vulncheck.com/advisories/odt2spip-os-command-...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Valentin Lobstein (Chocapikk)
.