CVE-2026-104085
CVSS 8.8 HIGH: odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated… EPSS 2% (84th percentile).
Vulnerabilities & Exploits · Web App Attack
VulnCheck says SPIP’s odt2spip document-import plugin is being actively exploited through CVE-2026-104085, a command-injection flaw in versions up to 4.3.0. A low-privilege SPIP redacteur can abuse a crafted upload to run code as the web server user.
The bug sits in filename handling: odt2spip takes the uploaded document’s name, builds a shell command around it, and does not strip shell metacharacters from the path it hands to LibreOffice. That means the filename itself can carry extra commands, so what looks like a routine document import becomes host-level execution.
The issue matters most on multi-author SPIP sites, where article writers are not supposed to have server execution rights. VulnCheck’s report also points to a broader audit question for other import plugins that pass user-supplied filenames into shell tools.
1 source · 6h ago
CVSS 8.8 HIGH: odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated… EPSS 2% (84th percentile).
VulnCheck
SPIP odt2spip Plugin: Authenticated Command Injection via Uploaded Document Filename | Blog | VulnCheck
VulnCheck's Initial Access Intelligence team details an authenticated OS command injection in the SPIP odt2spip plugin, where an uploaded document's filename is concatenated into a shell command and run, giving any low-privileged author remote code execution as the web server user.
originalPart of the PlainSec briefing for 2026-10-16
Every edition of this story: SPIP odt2spip lets redacteurs reach code execution