CVE-2026-104085: Command Injection in SPIP odt2spip Plugin

Vulncheck

CVE-2026-104085: Command Injection in SPIP odt2spip Plugin

First seen 16 Oct 2026, 13:38 UTC • •63.0

Article Content

1 / 4

Browse articles

ThreatCluster •October 16, 2026 at 13:39 UTC

•CVE-2026-104085 allows command injection via malicious document filenames.
•Affected versions of odt2spip include all prior to 4.4.0, with a patch released on 2026-10-07.
•Exploitation requires only a low-privilege authenticated account to execute arbitrary commands.

VulnCheck disclosed CVE-2026-104085, an OS command injection vulnerability in the odt2spip plugin for SPIP CMS versions up to 4.3.0. This flaw allows authenticated authors to execute arbitrary commands by uploading documents with malicious filenames. The vulnerability arises from insufficient sanitization of user-supplied filenames, which can include shell metacharacters. Affected users are those with low-privilege accounts who can upload documents. The risk is significant as it can lead to remote code execution as the web server user. The vulnerability was patched in version 4.4.0, released on 2026-10-07. Current CVSS score is 8.8, indicating a high severity level. No has been reported as of now.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 2h ago How this analysis works

Timeline

2026-10-07

Patch released for odt2spip

Version 4.4.0 was released to fix the command injection vulnerability.

2026-10-13

CVE-2026-104085 published

VulnCheck disclosed the vulnerability, detailing its impact and risk factors.

More articles in this cluster (3)

Threat Graph

7 entities, 10 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Zero-day Exploit
T1059 - Command and Scripting Interpreter

Vulnerability (1)

CVE-2026-104085

Weakness (1)

CWE-78 - OS Command Injection

Affected Platform (3)

LibreOffice
PHP
SPIP

Relationships

CVE-2026-104085 targets LibreOffice
CVE-2026-104085 targets PHP
CVE-2026-104085 targets SPIP
Zero-day Exploit targets LibreOffice
Zero-day Exploit targets PHP
Zero-day Exploit targets SPIP
T1059 - Command and Scripting Interpreter targets LibreOffice
T1059 - Command and Scripting Interpreter targets PHP
T1059 - Command and Scripting Interpreter targets SPIP
CVE-2026-104085 related to CWE-78 - OS Command Injection

Following this threat?

Track CVE-2026-104085 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What versions are affected by CVE-2026-104085?

All versions of the odt2spip plugin prior to 4.4.0 are affected.

Has this vulnerability been exploited in the wild?

No active exploitation has been reported as of now.

What should users do to protect themselves?

Users should upgrade to odt2spip version 4.4.0 or later to mitigate the vulnerability.

Continue Reading

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting…