CVE-2026-114404
Received Received - Intake

XSS in PHPOffice PHPPresentation HTML Writer

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: VulnCheck

Description
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attributes that are emitted unescaped, executing script in viewers' browsers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-114404
EUVD
EUVD-2026-107251

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
PHPOffice PHPPresentation 1.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-114404 is a cross-site scripting (XSS) vulnerability in PHPOffice PHPPresentation version 1.2.0. It exists in the HTML writer component where malicious input in text runs, hyperlink targets, or shape descriptions is not properly sanitized. This allows attackers to inject and execute arbitrary scripts in the browsers of users viewing the generated HTML content.

Detection Guidance

To detect this vulnerability, inspect PHPPresentation version 1.2.0 installations for untrusted input in text runs, hyperlinks, or shape descriptions that may contain script tags. Check HTML output files generated by the library for unsanitized content. Use static analysis tools to scan for CWE-79 violations in the HTML writer component.

Impact Analysis

Attackers can craft a PPTX file with malicious content that executes scripts when viewed in a browser. This could lead to unauthorized actions on behalf of the user, data theft, session hijacking, or defacement of the presentation content. Users viewing infected presentations are at risk even without downloading files.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information if presentations contain such data. Organizations must ensure presentations are sanitized before sharing to maintain compliance.

Mitigation Strategies

Immediately upgrade PHPPresentation to a patched version beyond 1.2.0. If upgrading is not possible, disable the HTML writer component or sanitize all user-supplied input before processing. Avoid using PHPPresentation with untrusted files, especially .pptx or .phppt formats.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114404. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...