CVE Alert: CVE-2026-104085 – odt2spip

odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.

**Risk verdict:** High-impact remote compromise is plausible, but current SSVC data reports no exploitation; confirm KEV, PoC and EPSS status before setting final urgency.

**Why this matters:** Successful exploitation can give an attacker command execution in the web-service context, potentially exposing application data, disrupting service or providing a foothold for further attacks. The main business risk is compromise of a public-facing content-management environment and any sensitive material or credentials accessible to its service account.

**Most likely attack path:** An attacker needs a low-privilege authenticated author account and network access to the import function; no separate user action is required. A crafted upload can trigger command execution during document handling. Scope is unchanged, so broader access is not automatic, but reachable internal services or credentials available to the web server could enable follow-on movement.

**Who is most exposed:** Sites using the document-import plugin, especially internet-facing SPIP installations that allow author accounts to upload documents, are most exposed. The prevalence of this feature and whether uploads reach a conversion service need confirmation.

Review web and application logs for unusual author uploads and import requests.

Alert on shell metacharacters or command-like strings in uploaded filenames.

Look for unexpected child processes launched by the web or conversion service.

Check for anomalous outbound connections or new files owned by the service account.

Mitigation and prioritisation:

Upgrade to the vendor-fixed release; expedite for internet-facing instances.

Temporarily disable document import or restrict it to trusted authors.

Isolate the conversion service and limit its filesystem, network and account privileges.

Validate KEV, PoC and EPSS status; plan and test changes without delaying urgent exposure reduction.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.