SPIP odt2spip Plugin Patched for Authenticated Remote Code Execution Flaw

VulnCheck disclosed CVE-2026-104085, an operating system command injection vulnerability in the odt2spip plugin for the SPIP content management system. The flaw allows authenticated users with author privileges to execute arbitrary commands on the server hosting the CMS application.

The vulnerability enables remote code execution as the web server user. Attackers achieve this by uploading a document with a filename containing shell metacharacters. The plugin processes this filename during document import without sufficient sanitization, leading to command execution.

Technical Context and Disclosure

VulnCheck’s Initial Access Intelligence team detailed the issue in a recent advisory. The plugin facilitates importing office documents into articles. It moves uploaded files to a path constructed from the client-supplied filename. This path is then passed to LibreOffice via a shell command.

The filename is concatenated into the command with minimal escaping. Shell metacharacters such as dollar signs and parentheses survive the process. This allows attackers to inject and execute arbitrary commands during the conversion phase.

The NVD record lists the CVSS score as 8.7, categorizing the severity as high. VulnCheck calculated a CVSS 3.1 score of 8.8 for the same issue. Both ratings reflect the significant impact of remote code execution on the affected systems.

The weakness is classified as CWE-78, which denotes improper neutralization of special elements used in an OS command. This classification aligns with the mechanism of injecting shell commands through filename manipulation.

Affected Versions and Remediation

The odt2spip plugin versions up to and including 4.3.0 are affected by this vulnerability. Version 4.4.0, released on October 7, 2026, contains a verified fix for the command injection flaw. Users should upgrade to this version or later to mitigate the risk.

The plugin requires the saisies plugin and a LibreOffice binary on the host system. These dependencies are necessary for the document conversion feature that triggers the vulnerability. Without these components, the specific attack path described by VulnCheck is not reachable.

As Threat Times reported on October 15, 2026, similar critical remote command injection flaws have been patched in Wavlink router firmware. This highlights a broader trend of command injection vulnerabilities in software handling external inputs.

The attack requires an authenticated account with the redacteur role. This is a standard author role in SPIP, not an administrator account. Consequently, any user who can create or modify articles can exploit this flaw to gain full server access.

What should you do?

Site administrators running SPIP should immediately verify their odt2spip plugin version. If the version is 4.3.0 or earlier, they should update to the latest available release. Monitoring server logs for unusual command executions can help detect exploitation attempts.