CVE-2026-104085

Summary

The odt2spip plugin in SPIP before version 4.4.0 has an OS command injection vulnerability that allows authenticated users to execute arbitrary commands by uploading documents with malicious filenames containing shell metacharacters. This flaw enables attackers to run code as the web server user during document conversion.

Exploitability

Exploitation requires an authenticated author account and involves uploading a crafted document filename, making it moderately difficult but achievable with a compromised user account.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary commands on the web server as the web server user, potentially leading to full server compromise or data exfiltration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to SPIP 4.4.0 or later to remediate this OS command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.