CVE-2026-104085: OS Command Injection in odt2spip SPIP Plugin

The odt2spip plugin for SPIP before version 4.4.0 contains an OS command injection vulnerability (CVE-2026-104085) originating from insufficient input sanitization of filenames. An authenticated author can upload a document with a maliciously crafted filename containing shell metacharacters - such as $(id) - through the document import form. This input is improperly handled by the odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand() functions. When the plugin initiates the LibreOffice conversion process, these unsanitized characters are passed to the system shell, resulting in remote code execution (RCE) with the privileges of the web-server user. This vulnerability highlights the risks associated with passing user-supplied filenames directly to system commands.

Impact

Successful exploitation allows an authenticated author to execute arbitrary operating system commands as the web-server user. This could lead to full compromise of the web application, lateral movement within the network, or data exfiltration. The severity is marked as high (CVSS 8.8) due to the potential for complete system compromise within the context of the web-server account.

Recommendation

• Patch the vulnerable plugin by upgrading to SPIP odt2spip version 4.4.0 or later immediately.
• Audit logs for suspicious file upload activity originating from author-level accounts, specifically monitoring for filenames containing shell metacharacters such as semicolon, pipe, ampersand, and dollar sign substitution syntax.
• Implement strict input validation on the web server to block files with non-standard characters in the naming convention of uploaded documents.