[ CVE-2026-104085 · Published 13 Oct 2026 ]
Vulnerability in odt2spip
CVSS 8.8
EPSS 2%No fix listed yet
[ Description ]Official description
odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.