{"id":"CVE-2026-104085","published":"2026-10-13T18:17:12.727","lastModified":"2026-10-16T18:25:45.343","description":"odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://plugins.spip.net/odt2spip.html","tags":[]},{"url":"https://www.vulncheck.com/advisories/odt2spip-os-command-injection-via-document-filename","tags":[]},{"url":"https://www.vulncheck.com/blog/spip-odt2spip-authenticated-command-injection-rce","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The odt2spip plugin in SPIP before version 4.4.0 has an OS command injection vulnerability that allows authenticated users to execute arbitrary commands by uploading documents with malicious filenames containing shell metacharacters. This flaw enables attackers to run code as the web server user during document conversion.","exploitability":"Exploitation requires an authenticated author account and involves uploading a crafted document filename, making it moderately difficult but achievable with a compromised user account.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary commands on the web server as the web server user, potentially leading to full server compromise or data exfiltration.","remediation":"Upgrade to SPIP 4.4.0 or later to remediate this OS command injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","web","auth"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:50:04.194Z"}}