{"id":"CVE-2026-114403","kind":"vulnerability","aliases":["CVE-2026-114403"],"related":[],"title":"PHPPresentation: crafted PPTX file triggers PHP object injection and code execution","description":"PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.","summary":"PHPPresentation, a PHP library for reading and writing presentation files, passes a value from a crafted presentation file into unserialize(). An attacker who supplies such a file can instantiate arbitrary PHP objects, which can lead to code execution, file writes, or denial of service.","severity":"critical","cvss":9.2,"epss":0.00477,"exploited":false,"exploited_at":null,"products":[{"name":"phpoffice/phppresentation","fixed":[],"affected":"<= 1.2.0","ecosystem":"composer"}],"ecosystems":["composer"],"tags":["composer","deserialization","file-upload","package","php","phpoffice","phppresentation"],"not_affected_if":["no-untrusted-presentation-input","version-above-1.2.0"],"how_to_check":"Run composer show phpoffice/phppresentation and check whether the version is 1.2.0 or lower.","fix":"No fixed version or patch commit exists yet (upstream issue #892 open; 1.3.0 unreleased). Mitigate: never pass untrusted files to IOFactory::load (it auto-detects the Serialized format); use IOFactory::createReader('PowerPoint2007') explicitly, or reject ZIPs containing PhpPresentation.xml. Watch the 1.3.0 release.","status":"open","published_at":"2026-10-21T13:18:31+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-23T22:33:17+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:33:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"PHPPresentation: crafted PPTX file triggers PHP object injection and code execution","impact":"high","summary":"PHPPresentation, a PHP library for reading and writing presentation files, passes a value from a crafted presentation file into unserialize(). An attacker who supplies such a file can instantiate arbitrary PHP objects, which can lead to code execution, file writes, or denial of service.","category":"package","who_cares":["php","composer","file-upload"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the server via gadget chain from uploaded file","analyst_note":"Confirm the fixed version and the patch commit; the sources list no fixed version and the NVD page is the only source.","how_to_check":"Run composer show phpoffice/phppresentation and check whether the version is 1.2.0 or lower.","needs_analyst":true,"not_affected_if":["version-above-1.2.0","no-untrusted-presentation-input"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000496,"input_tokens":3011,"output_tokens":389,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the patch commit; the sources list no fixed version and the NVD page is the only source.","search":"'-114403':14A,17A '-2026':13A,16A '1.2.0':75C 'allow':82C 'arbitrari':57B,86C 'attack':49B,83C,95C 'chain':111C 'code':10A,64B,112C 'compos':19B 'contain':76C,100C 'craft':2A,43B,92C 'cve':12A,15A 'denial':69B,117C 'deseri':20B,79C 'enabl':108C 'execut':11A,65B,113C 'file':4A,22B,37B,45B,54B,66B,94C,114C 'file-upload':21B 'gadget':110C 'gadget-chain':109C 'inject':8A 'insecur':78C 'instanti':56B,85C 'iofactori':103C 'lead':62B 'librari':31B 'load':104C 'object':7A,59B,88C 'packag':24B 'pass':38B,105C 'php':6A,25B,30B,58B,87C 'phpoffic':26B,72C 'phpoffice/phppresentation':18A 'phppresent':1A,27B,28B,73C 'phppresentation.xml':101C 'pptx':3A 'present':36B,44B,93C 'read':33B 'servic':71B,119C 'suppli':51B,90C 'trigger':5A 'unseri':47B,107C 'upload':23B,97C 'valu':40B 'vulner':80C 'write':35B,67B,115C 'zip':99C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:18:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-114403","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114403","severity":null,"published_at":"2026-10-21T13:18:31+00:00","modified_at":"2026-10-22T17:39:56+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114403:239","url":null,"severity":null,"published_at":"2026-10-23T22:30:45+00:00","modified_at":"2026-10-23T22:30:45+00:00","first_seen_at":"2026-10-23T22:30:45+00:00","fetched_at":"2026-10-23T22:30:45+00:00","note":"VulnCheck CNA advisory + researcher PoC (hackmd, leediay): Reader\\Serialized::load unserialize()s base64 <data> from PhpPresentation.xml in uploaded ZIP; no gadget chain needed in the library itself but RCE needs a gadget class in the app's autoload. No fixed version: 1.2.0 is latest release and master still has the unserialize call. No exploitation reports found; PoC public. Sibling CVE-2026-114404 (HTML writer XSS) same product. Social search skipped."},{"source":"analyst","external_id":"CVE-2026-114403:314","url":null,"severity":null,"published_at":"2026-10-23T22:51:50+00:00","modified_at":"2026-10-23T22:51:50+00:00","first_seen_at":"2026-10-23T22:51:50+00:00","fetched_at":"2026-10-23T22:51:50+00:00","note":"Re-checked: upstream issue #892 (fa1c4, opened 2026-06-29) is still open; master commits through 2026-10-19 show no deserialization fix; 1.3.0 is unreleased and 1.2.0 is the latest tag. So fixed version is still unknown; no patch commit exists. Linked the issue."},{"source":"epss","external_id":"CVE-2026-114403","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114403","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1481,"url":"https://www.vulncheck.com/advisories/phpoffice-phppresentation-through-1.2.0-deserialization-via-reader-serialized-load","title":"VulnCheck advisory CVE-2026-114403","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1482,"url":"https://hackmd.io/@leediay/multiple_vulnerable_phppresentation","title":"leediay: PHPPresentation Reader\\Serialized unserialize PoC","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1483,"url":"https://github.com/PHPOffice/PHPPresentation/blob/master/src/PhpPresentation/Reader/Serialized.php","title":"Reader/Serialized.php on master (still unserialize without allowed_classes)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1484,"url":"https://github.com/PHPOffice/PHPPresentation/releases","title":"PHPPresentation releases (latest 1.2.0)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1631,"url":"https://github.com/PHPOffice/PHPPresentation/issues/892","title":"PHPPresentation #892: unsafe deserialization in Serialized reader (open)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}