The vulnerability originates from insufficient sanitization of uploaded document filenames in the odt2spip plugin. A malicious author can craft a filename embedding shell metacharacters, such as $(id), that survive the odt2spip_deplacer_fichier_upload() routine and reach LibreOffice::createCommand(). During the conversion step the web‑server user runs the command, yielding full remote code execution on the hosting system.

Any site running the odt2spip plugin for SPIP with a version lower than 4.4.0 is affected. The plugin is used by SPIP sites to import OpenDocument Text files via an upload form accessible to authenticated authors. No specific platform or OS is mentioned; the flaw operates within the PHP plugin and the LibreOffice service on the server.

The flaw has a CVSS score of 8.7, indicating a high severity. Although EPSS is not available, the absence of a KEV listing does not diminish the risk, as the attack requires only a valid author account and the ability to upload a document. The attack vector is local from the application perspective but achieves remote code execution on the web server. Because the vulnerability is triggered during a normal file‑upload operation, it can be exploited by any adversary who compromises or masquerades as an author.