CVE-2026-104085 | BDVDB-2026-388313 Detail

Description#

odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-13Record published in the CVE List.
2. Version 22026-10-29Most recent update recorded in the CVE List.