Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck

CVE-2026-104085odt2spip < 4.4.0 OS Command Injection via Document Filename

High 8.8

In plain English

A high-severity OS command injection in odt2spip from odt2spip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)2.0%top 19.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	spip	no fix listed	UBUNTU-CVE-2026-104085
Ubuntu:24.04:LTS	spip	no fix listed	UBUNTU-CVE-2026-104085
Ubuntu:26.04:LTS	spip	no fix listed	UBUNTU-CVE-2026-104085
Ubuntu:26.10	spip	no fix listed	UBUNTU-CVE-2026-104085

Affected products (as reported)

Vendor	Product	Versions
odt2spip	odt2spip	0 – before 4.4.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Plugin Download Page product, patch
VulnCheck Advisory: odt2spip < 4.4.0 OS Command Injection via Document Filename third-party-advisory
VulnCheck Blog: SPIP odt2spip Plugin: Authenticated Command Injection via Uploaded Document Filename exploit, technical-description