Live › vulnerability › CVE-2026-114404
Go to dashboardPHPOffice PHPPresentation 1.2.0 writes presentation text, hyperlink targets and shape descriptions into generated HTML without escaping them. A crafted PPTX file can therefore run script in the browser of anyone who opens the generated HTML.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that accept PPTX uploads from users and convert them to HTML with PHPPresentation 1.2.0 are exposed, because the attacker's file content ends up in pages other users view. Systems that only process trusted presentations, or that never use the HTML writer, can skip it. The sources do not give more detail on the affected configurations.
No product ranges from the sources yet.
composer show phpoffice/phppresentation and look for 1.2.0.IOFactory::createWriter($presentation, 'HTML'), on user-supplied files.1.2.0; the fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attributes that are emitted unescaped, executing script in viewers' browsers.
This page as .md · .json · in your agent: get_signal("CVE-2026-114404")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.