CVE-2026-104085 odt2spip < 4.4.0 OS Command Injection via Document Filename
Authenticated authors can execute arbitrary OS commands via malicious filenames in the odt2spip plugin for SPIP.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104085?
CVE-2026-104085 is a high-severity command injection vulnerability in odt2spip, published on 13 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.
Weakness: CWE-78
Which versions are affected by CVE-2026-104085?
How do I fix CVE-2026-104085?
No fix has been published for CVE-2026-104085 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-104085 being exploited?
There is no known exploitation of CVE-2026-104085 in the wild and no public exploit code.
Sources
Also known as GHSA-87r4-r3m7-gvjv, UBUNTU-CVE-2026-104085.