Insecure Deserialization in PHPOffice PHPPresentation by PHPOffice
CVE-2026-114403

9.2CRITICAL

Key Information:

Vendor

PHPoffice

Status
PHPpresentation
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114403?

PHPOffice PHPPresentation through version 1.2.0 is vulnerable to an insecure deserialization flaw. This vulnerability enables threat actors to instantiate arbitrary PHP objects by providing a specially crafted presentation file. The issue arises when a ZIP file containing a malicious PhpPresentation.xml is processed, leading the IOFactory::load function to unserialize the content. This could allow for various exploitations, such as execution of gadget-chain code, unauthorized file writes, or even denial of service attacks.

Affected Version(s)

PHPPresentation 0 <= 1.2.0

References

https://hackmd.io/@leediay/multiple_vulnerable_phppresent...
third-party-advisory
https://github.com/PHPOffice/PHPPresentation/blob/1.2.0/s...
technical-description
https://github.com/PHPOffice/PHPPresentation/blob/1.2.0/s...
technical-description

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
.