CVE-2026-104085

CVSS 8.8 (high) · published 2026-10-13

odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.

Weakness: CWE-78

Source: NVD CVE-2026-104085

References

• https://plugins.spip.net/odt2spip.html
• https://www.vulncheck.com/advisories/odt2spip-os-command-injection-via-document-filename
• https://www.vulncheck.com/blog/spip-odt2spip-authenticated-command-injection-rce

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.