{"id":"CVE-2026-104085","revision":"8d9e3393750d4ac48c7465a79ae97ac5","records":[{"revision":"8d9e3393750d4ac48c7465a79ae97ac5","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-104085","aliases":[],"title":"odt2spip < 4.4.0 OS Command Injection via Document Filename","description":"odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.","state":0,"publishedAt":"2026-10-13T17:28:18.915+00:00","modifiedAt":"2026-10-16T14:31:59.732+00:00","affected":[{"ecosystem":"Vendor product","name":"odt2spip","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"vendor\": \"odt2spip\",\n                    \"product\": \"odt2spip\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\",\n                            \"lessThanOrEqual\": \"4.4.0\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://plugins.spip.net/odt2spip.html","https://www.vulncheck.com/advisories/odt2spip-os-command-injection-via-document-filename","https://www.vulncheck.com/blog/spip-odt2spip-authenticated-command-injection-rce"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104085","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-104085","identifiers":["CVE-2026-104085"]},"retained":false,"historicalAffected":[]}],"coverage":[]}