CVE-2026-104085: SPIP odt2spip Plugin RCE Vulnerability

CVE-2026-104085 Overview

CVE-2026-104085 is an operating system (OS) command injection vulnerability in the odt2spip plugin for SPIP before version 4.4.0. The flaw allows authenticated users with author privileges to execute arbitrary shell commands on the underlying server. Attackers trigger the issue by uploading a document with a filename containing shell metacharacters through the document import form. The injected payload survives sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), reaching the shell during the LibreOffice conversion process. Successful exploitation yields remote code execution (RCE) as the web-server user. The weakness is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact

Authenticated authors can achieve remote code execution on the SPIP host by uploading a document with a crafted filename, compromising confidentiality, integrity, and availability of the web server.

Affected Products

• SPIP content management system with the odt2spip plugin installed
• odt2spip plugin versions prior to 4.4.0
• Server deployments relying on LibreOffice for ODT conversion via the plugin

Discovery Timeline

• 2026-10-13 - CVE-2026-104085 published to the National Vulnerability Database (NVD)
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-104085

Vulnerability Analysis

The odt2spip plugin converts uploaded OpenDocument Text (ODT) files into SPIP articles using LibreOffice as the conversion backend. During the upload workflow, the plugin passes the user-supplied filename to a shell command without proper neutralization of shell metacharacters. An authenticated author with permission to use the document import form can submit a non-.odt file whose name contains a payload such as $(id). The payload is interpreted by the shell when LibreOffice is invoked, producing command execution under the web-server account. Impact includes read and write access to SPIP content, pivot opportunities into the hosting environment, and potential persistence through the web application's writable directories.

Root Cause

The root cause is insufficient input sanitization inside odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(). Both functions treat the filename as a trusted string when assembling the LibreOffice conversion command line. Shell metacharacters, including $(), backticks, semicolons, and pipes, pass through unescaped. The plugin also fails to enforce a strict allowlist for filename characters or to invoke the external binary through a safer execution primitive that bypasses shell interpretation.

Attack Vector

Exploitation requires an authenticated SPIP account with author-level privileges and access to the document import form. The attacker uploads a file whose extension is not .odt, which forces the vulnerable conversion path, and whose basename embeds the injected shell expression. When the plugin builds the LibreOffice command string, the shell evaluates the metacharacters, executing the attacker's payload as the web-server user. No user interaction beyond the attacker's own authenticated session is required. See the VulnCheck Command Injection Advisory for additional technical context.

// No verified exploit code published. Refer to the VulnCheck advisory for details.

Detection Methods for CVE-2026-104085

Indicators of Compromise

• Uploaded files whose names contain shell metacharacters such as $, `, ;, |, &, or () recorded in SPIP upload logs
• Unexpected child processes of the web-server user spawning sh, bash, id, curl, wget, or python during document import
• LibreOffice (soffice) invocations where command-line arguments include substrings resembling injected shell expressions
• New or modified files under SPIP writable directories (IMG/, tmp/, local/) immediately after a document upload event

Detection Strategies

• Monitor process-execution telemetry on SPIP hosts for shell interpreters launched as children of the PHP or web-server process in the context of an odt2spip request.
• Inspect HTTP request logs for POSTs to the SPIP document import endpoint carrying multipart filenames with non-alphanumeric characters outside typical punctuation.
• Alert on LibreOffice conversion processes whose argument vector contains command-substitution tokens or redirection operators.

Monitoring Recommendations

• Enable verbose SPIP and web-server access logging that preserves full multipart filenames for post-incident review.
• Forward endpoint process events and file-integrity data from the SPIP host to a central analytics platform for correlation.
• Track outbound network connections initiated by the web-server user to detect post-exploitation egress such as reverse shells or payload downloads.

How to Mitigate CVE-2026-104085

Immediate Actions Required

• Upgrade the odt2spip plugin to version 4.4.0 or later on every SPIP installation.
• Audit author-level accounts and revoke access for untrusted or dormant users who can reach the document import form.
• Review web-server and application logs for upload events containing suspicious filenames since the plugin was installed.
• Rotate credentials and secrets accessible to the web-server user if evidence of exploitation is identified.

Patch Information

The maintainers address the vulnerability in odt2spip 4.4.0 by sanitizing uploaded filenames before they reach the LibreOffice conversion command. Administrators should install the fixed release through the SPIP plugin manager or by replacing the plugin directory with the patched version. Confirm the installed version afterward through the SPIP administration interface. Refer to the SPIP Plugin Documentation for installation and upgrade procedures.

Workarounds

• Disable or uninstall the odt2spip plugin until the patched version is deployed.
• Restrict access to the document import form at the web-server layer so only trusted administrator IP ranges can reach it.
• Enforce a strict filename allowlist (alphanumerics, dot, hyphen, underscore) using a web application firewall rule on upload endpoints.
• Run the SPIP web-server process under a dedicated, minimally privileged account with no shell access to limit post-exploitation reach.

# Example: block uploads whose filenames contain shell metacharacters at the WAF layer
# Pseudocode rule - adapt to your WAF syntax
if request.uri contains "/ecrire/" and request.method == "POST":
    if multipart.filename matches /[\$\`;|&\(\)<>\\]/:
        deny with 400