---
id: "CVE-2026-114403"
kind: "vulnerability"
aliases: ["CVE-2026-114403"]
title: "PHPPresentation: crafted PPTX file triggers PHP object injection and code execution"
severity: "critical"
cvss: 9.2
epss: 0.00477
exploited: false
status: "open"
category: "package"
products: [{"name": "phpoffice/phppresentation", "fixed": [], "affected": "<= 1.2.0", "ecosystem": "composer"}]
ecosystems: ["composer"]
tags: ["composer", "deserialization", "file-upload", "package", "php", "phpoffice", "phppresentation"]
not_affected_if: ["no-untrusted-presentation-input", "version-above-1.2.0"]
published_at: "2026-10-21T13:18:31+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114403", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:30:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:51:50+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114403", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# PHPPresentation: crafted PPTX file triggers PHP object injection and code execution

PHPPresentation, a PHP library for reading and writing presentation files, passes a value from a crafted presentation file into unserialize(). An attacker who supplies such a file can instantiate arbitrary PHP objects, which can lead to code execution, file writes, or denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:phpoffice/phppresentation affected <= 1.2.0 fixed ?

## How to check

Run composer show phpoffice/phppresentation and check whether the version is 1.2.0 or lower.

## Fix

No fixed version or patch commit exists yet (upstream issue #892 open; 1.3.0 unreleased). Mitigate: never pass untrusted files to IOFactory::load (it auto-detects the Serialized format); use IOFactory::createReader('PowerPoint2007') explicitly, or reject ZIPs containing PhpPresentation.xml. Watch the 1.3.0 release.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114403
- 2026-10-23T22:30:45+00:00 analyst — VulnCheck CNA advisory + researcher PoC (hackmd, leediay): Reader\Serialized::load unserialize()s base64 <data> from PhpPresentation.xml in uploaded ZIP; no gadget chain needed in the library itself but RCE needs a gadget class in the app's autoload. No fixed version: 1.2.0 is latest release and master still has the unserialize call. No exploitation reports found; PoC public. Sibling CVE-2026-114404 (HTML writer XSS) same product. Social search skipped.
- 2026-10-23T22:51:50+00:00 analyst — Re-checked: upstream issue #892 (fa1c4, opened 2026-06-29) is still open; master commits through 2026-10-19 show no deserialization fix; 1.3.0 is unreleased and 1.2.0 is the latest tag. So fixed version is still unknown; no patch commit exists. Linked the issue.
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114403

## Documents

- [advisory] VulnCheck advisory CVE-2026-114403 https://www.vulncheck.com/advisories/phpoffice-phppresentation-through-1.2.0-deserialization-via-reader-serialized-load
- [describes] Reader/Serialized.php on master (still unserialize without allowed_classes) https://github.com/PHPOffice/PHPPresentation/blob/master/src/PhpPresentation/Reader/Serialized.php
- [discussion] PHPPresentation #892: unsafe deserialization in Serialized reader (open) https://github.com/PHPOffice/PHPPresentation/issues/892
- [mentions] PHPPresentation releases (latest 1.2.0) https://github.com/PHPOffice/PHPPresentation/releases
- [poc] leediay: PHPPresentation Reader\Serialized unserialize PoC https://hackmd.io/@leediay/multiple_vulnerable_phppresentation

## From the sources

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_