{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aspipodt2spip/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:spip:odt2spip:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-104085"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["odt2spip (\u003c 4.4.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["SPIP"],"content_html":"\u003cp\u003eThe odt2spip plugin for SPIP before version 4.4.0 contains an OS command injection vulnerability (CVE-2026-104085) originating from insufficient input sanitization of filenames. An authenticated author can upload a document with a maliciously crafted filename containing shell metacharacters - such as $(id) - through the document import form. This input is improperly handled by the odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand() functions. When the plugin initiates the LibreOffice conversion process, these unsanitized characters are passed to the system shell, resulting in remote code execution (RCE) with the privileges of the web-server user. This vulnerability highlights the risks associated with passing user-supplied filenames directly to system commands.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated author to execute arbitrary operating system commands as the web-server user. This could lead to full compromise of the web application, lateral movement within the network, or data exfiltration. The severity is marked as high (CVSS 8.8) due to the potential for complete system compromise within the context of the web-server account.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch the vulnerable plugin by upgrading to SPIP odt2spip version 4.4.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit logs for suspicious file upload activity originating from author-level accounts, specifically monitoring for filenames containing shell metacharacters such as semicolon, pipe, ampersand, and dollar sign substitution syntax.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation on the web server to block files with non-standard characters in the naming convention of uploaded documents.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T18:38:14Z","date_published":"2026-10-13T18:38:14Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-104085/","summary":"The odt2spip plugin for SPIP before 4.4.0 is vulnerable to OS command injection, allowing authenticated authors to execute arbitrary commands during document conversion.","title":"CVE-2026-104085: OS Command Injection in odt2spip SPIP Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-104085/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:spip:odt2spip:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}