CVE-2026-104085

odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.

• https://plugins.spip.net/odt2spip.html
• https://www.vulncheck.com/advisories/odt2spip-os-command-injection-via-document-filename
• https://www.vulncheck.com/blog/spip-odt2spip-authenticated-command-injection-rce