Odt2Spip
Monthly
Authenticated OS command injection in the odt2spip plugin for SPIP before 4.4.0 allows author-level users to execute arbitrary commands as the web-server user by uploading a document with a crafted non-.odt filename through the document import form. The flaw survives sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), then triggers during LibreOffice conversion; exploitation requires a working LibreOffice backend and an author account. No public exploit was identified at time of analysis.
Authenticated OS command injection in the odt2spip plugin for SPIP before 4.4.0 allows author-level users to execute arbitrary commands as the web-server user by uploading a document with a crafted non-.odt filename through the document import form. The flaw survives sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), then triggers during LibreOffice conversion; exploitation requires a working LibreOffice backend and an author account. No public exploit was identified at time of analysis.