High priorityDisclosed

Advisory · CVE-2026-114403

PHPPresentation serialized reader can deserialize a crafted presentation file into object injection

PHPOffice PHPPresentation through 1.2.0 passes content loaded through IOFactory to unserialize in its Serialized reader, so a crafted presentation file in a ZIP can instantiate arbitrary PHP objects and enable gadget-chain code execution, file writes, or denial of service. CVSS 3.1 8.1 (CVSS 4.0 9.2).

Advisory published October 21, 2026Independent summary
Vendor
PHPOffice
Product
PHPPresentation
Identifier / CWE
CVE-2026-114403
CWE-502
Action timing
Immediate
ELI5

Explain it like I’m five

If an application opens a presentation file someone else made with this library, a hidden serialized payload inside the file gets unpacked as live PHP objects, and a rigged object chain can run code in the application.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted presentation prepared

    An attacker builds a ZIP containing a crafted PhpPresentation.xml with a serialized payload.

  2. 02Application loads the file

    An application using PHPPresentation loads the supplied file through IOFactory::load, as described in the record.

  3. 03Serialized reader unserializes content

    The load path passes the content to unserialize() in the Serialized reader, instantiating arbitrary PHP objects.

  4. 04Gadget chain fires

    Per the record, the instantiated objects can enable gadget-chain code execution, file writes, or denial of service in the host application.

What happened

VulnCheck disclosed CVE-2026-114403: PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability (CWE-502) that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Per the record, attackers can supply a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service. The CVSS 3.1 score is 8.1, with network attack vector, high complexity, no privileges, and no user interaction, and the CVSS 4.0 score is 9.2.

Per the affected data in the NVD record, versions through 1.2.0 are affected. No fixed version is claimed here, because the record does not state one; check the PHPOffice project for a release that addresses this CVE before treating an upgrade as a fix, and do not assume a version above 1.2.0 is fixed without a project statement.

What to do

  1. Inventory applications and services that use the PHPOffice PHPPresentation library, including document conversion, upload handling and reporting features, and note the version of each.
  2. Do not load presentation files from untrusted sources with affected versions, and disable or sandbox any feature that opens user-supplied presentation files until a project-confirmed fix is deployed.
  3. Watch the PHPOffice project for a release or advisory that addresses CVE-2026-114403, and upgrade promptly once a fixed release is stated by the project.
  4. Run any unavoidable presentation processing in an isolated worker with no credentials, no write access beyond a scratch area, and no network access.
  5. Hunt for crashes, unexpected file writes, and child processes in workers that processed presentation files, especially ZIP uploads containing PhpPresentation.xml.

Management note

PHPPresentation is embedded inside other applications, so the exposed surface is every upload and conversion feature that uses it, not a standalone server. Quarantine untrusted presentation files until the project states a fixed release, and inventory the library wherever PHP document handling runs.