From 2f88ea78308f238de9d88858dce955cd269330ef Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Wed, 30 Sep 2026 09:34:18 +0200
Subject: [PATCH] Escape arguments of report convert command

Closes #15035
---
 trytond/CHANGELOG                |  1 +
 trytond/trytond/report/report.py | 21 +++++++++++----------
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/trytond/CHANGELOG b/trytond/CHANGELOG
index 6889ea2640..ba7edbc7b4 100644
--- a/trytond/CHANGELOG
+++ b/trytond/CHANGELOG
@@ -1,3 +1,4 @@
+* Escape arguments of report convert command (issue15035)
 * Escape title and text when rendering HTML editor (issue15032)
 * Allow trytond-admin to manage any user
 * Add bulk_create, bulk_delete, bulk_save and bulk_func to ModelStorage
diff --git a/trytond/trytond/report/report.py b/trytond/trytond/report/report.py
index 49a301120e..20b99917d1 100644
--- a/trytond/trytond/report/report.py
+++ b/trytond/trytond/report/report.py
@@ -8,6 +8,7 @@ import mimetypes
 import operator
 import os
 import pathlib
+import shlex
 import shutil
 import subprocess
 import tempfile
@@ -451,20 +452,20 @@ class Report(URLMixin, PoolBase):
                 '--convert-to "%(output_extension)s" '
                 '--outdir "%(directory)s" '
                 '"%(input_path)s"')
-            cmd %= {
-                'directory': directory,
-                'input_format': input_format,
-                'input_extension': input_extension,
-                'input_path': input_path,
-                'output_format': output_format,
-                'output_extension': output_extension,
-                'output_path': output_path,
-                }
+            args = map(lambda s: s % {
+                    'directory': directory,
+                    'input_format': input_format,
+                    'input_extension': input_extension,
+                    'input_path': input_path,
+                    'output_format': output_format,
+                    'output_extension': output_extension,
+                    'output_path': output_path,
+                    }, shlex.split(cmd))
             for count in range(retry, -1, -1):
                 if count != retry:
                     time.sleep(0.02 * (retry - count))
                 try:
-                    subprocess.check_call(cmd, timeout=timeout, shell=True)
+                    subprocess.run(args, timeout=timeout, check=True)
                 except subprocess.CalledProcessError:
                     if count:
                         continue