CVE-2026-114403

Awaiting Analysis Awaiting Analysis - Queue

Insecure Deserialization in PHPOffice PHPPresentation

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulnCheck

Description

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114403

EUVD

EUVD-2026-107250

Affected Vendors & Products

Vendor	Product	Version / Range
PHPOffice	PHPPresentation	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is an insecure deserialization flaw in PHPOffice PHPPresentation through version 1.2.0. Attackers can upload a malicious ZIP file containing a crafted PhpPresentation.xml. When processed by IOFactory::load, the XML data is passed to unserialize(), allowing arbitrary PHP object instantiation. This can lead to gadget-chain code execution, file writes, or denial of service attacks.

Detection Guidance

Check for PHPPresentation library version 1.2.0 or earlier in your system. Look for files named PhpPresentation.xml inside ZIP archives that may be processed by the Serialized reader. Monitor for unexpected file writes or unusual PHP object instantiation in logs.

Impact Analysis

If you use PHPPresentation to process untrusted files, attackers could execute arbitrary code on your system, write malicious files, or crash your application. This requires uploading a specially crafted presentation file, which could be disguised as a normal .pptx or .phppt file.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or exfiltration, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations processing sensitive data with PHPPresentation may face compliance breaches if exploited.

Mitigation Strategies

Upgrade PHPPresentation to a version beyond 1.2.0 immediately. Disable the Serialized reader if not required. Restrict file uploads to trusted sources only. Implement strict input validation for uploaded files.

Hi! I’m here to help you understand CVE-2026-114403. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...