Organisations Risk Arbitrary Command Execution on SPIP Sites via odt2spip Filename Injection

The odt2spip plugin for the SPIP content management system contained an OS command injection flaw that allowed authenticated users to execute arbitrary system commands. According to VulnCheck, the vulnerability stemmed from insufficient sanitisation of uploaded document filenames. Attackers could embed shell metacharacters in filenames, which were then processed by the web server during document conversion, leading to remote code execution as the web server user.

How it unfolded

• VulnCheck’s Initial Access Intelligence team identified the authenticated OS command injection in the odt2spip plugin.
• The researchers detailed how uploaded document filenames were concatenated into shell commands with minimal escaping.
• The vendor released version 4.4.0 on 2026-10-07 to address the vulnerability, according to the disclosure.

Who is affected

Organisations using the SPIP CMS with the odt2spip plugin installed are affected if they run versions up to and including 4.3.0. The flaw impacts any multi-author SPIP site where users hold the standard redacteur role, which permits creating or modifying articles. According to VulnCheck, this low-privilege account type can escalate to remote code execution on the host. The plugin requires a LibreOffice binary to be resolvable on the conversion path for the exploit to succeed.

The fix

Version 4.4.0 of the odt2spip plugin fixes the OS command injection vulnerability. The update was released on 2026-10-07, according to VulnCheck. The fix addresses the insufficient sanitisation in the odt2spip_deplacer_fichier_upload and LibreOffice::createCommand functions. Users should verify their installation runs version 4.4.0 or later to mitigate the risk of arbitrary command execution via malicious filenames.

What analysts watch for

Teams usually monitor for unusual process spawning from web servers, particularly when document conversion tools are involved. Analysts examine logs for filenames containing shell metacharacters such as dollar signs or parentheses, which often indicate injection attempts. They also check for outbound connections from web server processes that should only handle local file operations. Monitoring for unexpected command execution during file uploads helps detect early stages of exploitation.

What to do and how to stay safe

• Verify the installed version of the odt2spip plugin and update to 4.4.0 or later once available.

Step-by-step guide: Patch Management: Eight Questions Answered for Stability

General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.