Upgrade SPIP odt2spip to 4.4.0 to Stop Filenames From Triggering Arbitrary Code Execution on Your Server
A vulnerability in the SPIP odt2spip plugin allows authors to run system commands via filenames. Version 4.4.0 patches the issue, which was rated high severity by researchers.
Key points
- CVE-2026-104085 allows authenticated authors to execute arbitrary code on SPIP sites.
- The flaw exists in odt2spip versions prior to 4.4.0, released on October 7, 2026.
- Attackers exploit weak filename sanitization to inject shell metacharacters during document import.
The SPIP odt2spip plugin has a security flaw that lets regular authors run system commands on web servers. This happens when they upload documents with specially crafted filenames. The issue affects versions before 4.4.0 and has been rated high severity. A patch is available for download.
In plain English
When authors use the odt2spip plugin to import office documents like Word files, the system converts them. The plugin uses the original filename to move the file and start the conversion process. If the filename contains special characters, those characters are passed directly to the system shell. This allows the filename to act as a command rather than just a name.
The background
VulnCheck researchers discovered that the plugin did not properly clean filenames before using them in shell commands. The code used a function that only escaped quotes and backslashes, leaving other dangerous characters intact. As a result, an attacker could embed commands in the filename. The system would execute these commands as the web server user during the conversion.
What changes now
The vendor released version 4.4.0 on October 7, 2026, to fix the vulnerability. This update ensures that filenames are properly sanitized before being used in system commands. Sites running older versions of the plugin remain exposed to remote code execution. Administrators should verify their plugin version and apply the update to close this security gap.
Key terms explained
Remote code execution lets attackers run programs on a server. In this case, a low-privilege user gained full control. Command injection occurs when user input is treated as code. Teams usually check for weak input validation in file handling routines. Verify that filenames are sanitized before use. Ensure that only trusted extensions are processed. Monitor logs for unexpected shell activity or new files. Review user permissions to limit access to upload forms.
What to do and how to stay safe: SPIP
- Check if your SPIP site uses the odt2spip plugin and verify its version number.
- Upgrade to version 4.4.0 or later to apply the vendor's security patch.
- Audit user accounts with author permissions to ensure they are legitimate.
- Monitor server logs for unusual command executions or new file creations.
Step-by-step guide: Risk-Based Vulnerability Management: Benefits, Limits, and Reality
General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-104085?
It is an OS command injection vulnerability in the SPIP odt2spip plugin that allows authenticated users to execute arbitrary commands via crafted filenames.
Who can exploit this vulnerability?
Any user with an authenticated author account, such as a redacteur, can exploit this flaw by uploading a document with a malicious filename.
Does the fix require a server restart?
The source material does not specify whether a server restart is required after applying the 4.4.0 update, so check vendor documentation for deployment steps.
