CVE-2026-104085

Received Received - Intake

OS Command Injection in SPIP odt2spip Plugin

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104085

EUVD

EUVD-2026-98963

Affected Vendors & Products

Vendor	Product	Version / Range
odt2spip	odt2spip	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

The odt2spip plugin for SPIP before version 4.4.0 has an OS command injection vulnerability. Authenticated authors can upload files with malicious filenames containing shell metacharacters like $(id). The plugin fails to properly sanitize these filenames in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), allowing arbitrary command execution as the web server user during LibreOffice conversion.

Detection Guidance

To detect this vulnerability, check if the odt2spip plugin version is below 4.4.0. Inspect uploaded filenames for shell metacharacters like $(id) or backticks. Review server logs for suspicious LibreOffice conversion processes or unexpected command executions during file uploads.

Impact Analysis

If exploited, this vulnerability allows attackers to run arbitrary commands on the server with the privileges of the web server user. This could lead to full system compromise, data theft, or further network infiltration. The impact depends on server configuration and exposed services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Immediately update the odt2spip plugin to version 4.4.0 or later. Disable file uploads for non-trusted users until patched. Implement strict filename sanitization to block shell metacharacters. Monitor server processes for unauthorized command execution.

Hi! I’m here to help you understand CVE-2026-104085. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70