High severity8.1NVD Advisory· Published Oct 21, 2026
CVE-2026-114403
CVE-2026-114403
Description
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=1.2.0
Patches
Vulnerability mechanics
References
4- github.com/PHPOffice/PHPPresentation/blob/1.2.0/src/PhpPresentation/IOFactory.phpnvd
- github.com/PHPOffice/PHPPresentation/blob/1.2.0/src/PhpPresentation/Reader/Serialized.phpnvd
- hackmd.io/@leediay/multiple_vulnerable_phppresentationnvd
- www.vulncheck.com/advisories/phpoffice-phppresentation-through-1.2.0-deserialization-via-reader-serialized-loadnvd
News mentions
0No linked articles in our index yet.