odt2spip CVE-2026-104085

Requires an authenticated SPIP account with author privileges and access to the odt2spip document import form on a site running the plugin below version 4.4.0. The attacker must upload a document with a non-.odt filename containing shell metacharacters (e.g. $(id)); the injection is processed during the LibreOffice conversion step via odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), so a working LibreOffice conversion backend must be present. Limiting factors: exploitation is gated by the author-level authentication requirement (PR:L) and the presence of this specific plugin, which is not part of a default SPIP install; no user interaction by a victim is needed.

This is a genuine but access-gated priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with full High impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H) is consistent with the description: a network-reachable OS command injection (CWE-78) yielding remote code execution as the web-server user. The decisive limiting signal is PR:L - exploitation requires an authenticated SPIP author account, so this is not an unauthenticated internet-wide threat but a privilege-escalation/post-authentication RCE. No EPSS score, SSVC decision, or KEV status was provided in the input, and there is no POC flag, so exploitation probability cannot be quantified from the data; per precision rules this is 'no public exploit identified at time of analysis.' A vendor patch exists (SPIP odt2spip 4.4.0) and the report comes from VulnCheck, which raises confidence in validity but is not evidence of active exploitation. Net: a high-severity, credibly-reported flaw whose real-world risk is tempered by the authenticated-author prerequisite and the niche footprint of the affected plugin.

An attacker who holds (or phishes/registers) an author-level account on a SPIP site running odt2spip below 4.4.0 opens the document import form and uploads a file whose non-.odt filename embeds shell metacharacters such as $(id). When the plugin passes the filename to LibreOffice::createCommand() for conversion, the injected command executes as the web-server user, giving remote code execution. No public exploit code is identified in the provided data, but the attack is low-complexity (AC:L) and requires no user interaction.