Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

odt2spip lets attackers run commands via uploaded filename

CVE-2026-104085 · published 22 days ago
Summary

The odt2spip add‑on for SPIP versions before 4.4.0 lets a logged‑in author upload a document with a specially crafted name that can cause the web server to run any command it chooses. This happens because the file name is not properly cleaned before the system calls LibreOffice to convert the document. Update to version 4.4.0 or later, or remove the plug‑in until it can be patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
– odt2spip odt2spip <= 4.4.0
Ubuntu:Pro:16.04:LTS canonical spip All versions
Original advisory text
odt2spip < 4.4.0 OS Command Injection via Document Filename
odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.7 High
Exploitation
2% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published13 Oct 2026
Updated30 Oct 2026
First seen13 Oct 2026
Sources
CVE-2026-104085 · NVD
CVE-2026-104085 · MITRE
UBUNTU-CVE-2026-104085 · OSV
Track software like this
Free during beta