Managed Sites Exposed to RCE via SPIP odt2spip Plugin Until 4.4.0 Patch Applied
VulnCheck disclosed an authenticated command injection in the SPIP odt2spip plugin, allowing low-privileged authors to execute code on web servers through crafted filenames.
Key points
- CVE-2026-104085 is rated High severity with a CVSS score of 8.7 or 8.8 depending on the source.
- The vulnerability affects SPIP sites running the odt2spip plugin versions up to and including 4.3.0.
- A fix is available in version 4.4.0, released on October 7, 2026, according to VulnCheck.
The SPIP odt2spip plugin versions prior to 4.4.0 contain an OS command injection flaw that permits authenticated authors to execute arbitrary commands on web servers by uploading documents with malicious filenames. VulnCheck disclosed this vulnerability, identified as CVE-2026-104085, noting that the defect allows low-privileged users to achieve remote code execution as the web server user during the file conversion process.
How it unfolded
- VulnCheck's Initial Access Intelligence team published research detailing an authenticated OS command injection in the SPIP odt2spip plugin.
- The vendor released version 4.4.0 on October 7, 2026, which VulnCheck states includes a verified fix for the vulnerability.
- The NVD assigned a CVSS score of 8.7 High to CVE-2026-104085, while VulnCheck calculated a CVSS 3.1 score of 8.8 High for the same issue.
Who is affected
SPIP content management systems using the odt2spip contrib plugin are affected if they run versions up to and including 4.3.0, according to VulnCheck. The flaw impacts the document import form available to users with the ordinary redacteur role, which is a low-privilege account that can create or modify articles but is not an administrator. Attackers can exploit this by uploading non-.odt files such as .doc, .docx, or .html with filenames containing shell metacharacters that survive insufficient sanitization.
The plugin relies on a libreoffice binary for conversion, and the vulnerability occurs when the raw client-supplied filename is concatenated into a shell command with almost no escaping, as described by VulnCheck. This allows the execution of arbitrary commands as the web server user, turning a standard author account into a vector for host compromise on any multi-author SPIP site that has the plugin installed.
Our take on the response
The availability of version 4.4.0 provides a clear remediation path for managed service providers overseeing SPIP installations. VulnCheck confirmed the fix in source code, which suggests that applying this update effectively closes the command injection vector without requiring complex workarounds. That indicates a straightforward patching process for administrators, provided they can verify that the libreoffice dependency remains compatible after the upgrade.
Who needs to act first
Teams should prioritize updating exposed SPIP instances that allow low-privileged authors to upload documents. Check whether the odt2spip plugin is active and at a vulnerable version before deploying the patch. Roll out the update to a test environment first to ensure compatibility with existing content and the LibreOffice conversion path. Back up site data and configurations prior to applying changes to enable rollback if issues arise. Monitor logs for unusual file uploads or command execution attempts during the transition period.
What to do and how to stay safe: SPIP
- Verify if your SPIP installations use the odt2spip plugin and identify the current version number.
- Apply version 4.4.0 or later once the vendor provides an update to address the command injection flaw.
- Review user permissions to ensure only necessary accounts have access to document import forms.
- Monitor web server logs for suspicious activity related to file uploads and command execution attempts.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this SPIP vulnerability?
The CVE ID is CVE-2026-104085, which describes an OS command injection in the odt2spip plugin.
Which versions of the odt2spip plugin are vulnerable?
Versions up to and including 4.3.0 are affected, while version 4.4.0 contains the fix.
What privileges does an attacker need to exploit this flaw?
An attacker needs an authenticated account with the low-privileged redacteur role, which allows creating or modifying articles.
