SPIP odt2spip Plugin: Authenticated Command Injection via Uploaded Document Filename

VulnCheck’s Initial Access Intelligence team details an authenticated OS command injection in the SPIP odt2spip plugin, where an uploaded document’s filename is concatenated into a shell command and run, giving any low-privileged author remote code execution as the web server user.