SPIP odt2spip plugin: OS command injection via document filename
Summary
The odt2spip plugin for the SPIP content management system contains an OS command injection vulnerability in its document import form. An authenticated author can upload a document with a crafted filename containing shell metacharacters such as $(id), which is passed unsanitized to the LibreOffice conversion process. This allows execution of arbitrary commands as the web-server user.
Affected
- odt2spip versions before 4.4.0 (VulnCheck advisory lists affected up to and including 4.4.0; the CVE description says before 4.4.0; treat 4.4.0 as fixed until the vendor page confirms)
- Requires an installed odt2spip plugin on a SPIP site and a user with author rights (redacteur)
Fixed in
- odt2spip 4.4.0 (released 2026-10-07)
Workaround
- Deactivate the odt2spip plugin until the update to 4.4.0 can be applied
- Restrict author accounts to trusted users
Exploitation
- No confirmed exploitation in the wild known; CISA KEV not listed
- VulnCheck describes a proof-of-concept module for the full attack chain; public availability is unverified
- VulDB states no exploit exists; CISA SSVC lists exploitation as none, automatable as no, technical impact as total
Our recommendation
- Check whether any SPIP site has the odt2spip plugin installed and which version it runs
- Update odt2spip to 4.4.0 or later after confirming the fix on plugins.spip.net; if the update is delayed, deactivate the plugin
- Review and restrict accounts with author rights, since an attacker needs one
- Review web-server and upload logs for unusual filenames or unexpected child processes of the web server
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- odt2spip plugin page (SPIP) plugins.spip.net
- VulnCheck advisory www.vulncheck.com
- VulnCheck blog www.vulncheck.com
- Chocapikk write-up chocapikk.com
- VulDB entry vuldb.com
- Strix CVE entry www.strix.ai
- OSV Ubuntu entry osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:23.
Original description (NVD)
odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.