{"id":"CVE-2026-114404","kind":"vulnerability","aliases":["CVE-2026-114404"],"related":[],"title":"PHPPresentation: HTML writer lets crafted PPTX inject script into pages","description":"PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attributes that are emitted unescaped, executing script in viewers' browsers.","summary":"PHPOffice PHPPresentation 1.2.0 writes presentation text, hyperlink targets and shape descriptions into generated HTML without escaping them. A crafted PPTX file can therefore run script in the browser of anyone who opens the generated HTML.","severity":"medium","cvss":6.1,"epss":0.00258,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["composer","file-upload","package","php","phppresentation"],"not_affected_if":["html-writer-unused","trusted-input-only"],"how_to_check":"- Check the installed version with `composer show phpoffice/phppresentation` and look for `1.2.0`.\n- Search your code for calls to the HTML writer, such as `IOFactory::createWriter($presentation, 'HTML')`, on user-supplied files.","fix":"- Upgrade phpoffice/phppresentation past `1.2.0`; the fixed version is unknown from the sources.\n- Until then, sanitize or escape the generated HTML before serving it, or do not render untrusted PPTX files to HTML.","status":"open","published_at":"2026-10-21T13:18:31+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:03:30+00:00","updated_at":"2026-10-25T04:03:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:03:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade phpoffice/phppresentation past `1.2.0`; the fixed version is unknown from the sources.\n- Until then, sanitize or escape the generated HTML before serving it, or do not render untrusted PPTX files to HTML.","reach":"internet","title":"PHPPresentation: HTML writer lets crafted PPTX inject script into pages","impact":"medium","summary":"PHPOffice PHPPresentation 1.2.0 writes presentation text, hyperlink targets and shape descriptions into generated HTML without escaping them. A crafted PPTX file can therefore run script in the browser of anyone who opens the generated HTML.","category":"package","nicknames":[],"who_cares":["php","phppresentation","composer","file-upload"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Script runs in a viewer's browser on the generated page","analyst_note":"Find the fixed version and the advisory with the affected-version range at the NVD entry, https://nvd.nist.gov/vuln/detail/CVE-2026-114404; the sources do not name a patched release.","how_to_check":"- Check the installed version with `composer show phpoffice/phppresentation` and look for `1.2.0`.\n- Search your code for calls to the HTML writer, such as `IOFactory::createWriter($presentation, 'HTML')`, on user-supplied files.","needs_analyst":true,"not_affected_if":["html-writer-unused","trusted-input-only"],"who_is_affected":"Applications that accept PPTX uploads from users and convert them to HTML with PHPPresentation 1.2.0 are exposed, because the attacker's file content ends up in pages other users view. Systems that only process trusted presentations, or that never use the HTML writer, can skip it. The sources do not give more detail on the affected configurations.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000673,"input_tokens":3393,"output_tokens":668,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114404':13A,16A '-2026':12A,15A '1.2.0':26B,61C 'allow':74C 'anyon':53B 'attack':75C,86C 'attribut':101C 'browser':51B,110C 'compos':17B 'contain':62C 'content':79C 'craft':5A,42B,88C 'cross':65C 'cross-sit':64C 'cve':11A,14A 'descr':100C 'descript':34B 'emit':104C 'escap':39B 'execut':106C 'file':19B,44B 'file-upload':18B 'generat':36B,57B,84C 'html':2A,37B,58B,71C,85C 'hyperlink':30B,95C 'inject':7A,81C 'let':4A 'malici':92C 'open':55B 'packag':21B 'page':10A 'php':22B 'phpoffic':24B,59C 'phppresent':1A,23B,25B,60C 'pptx':6A,43B,90C 'present':28B,78C 'relationship':96C 'run':47B,94C 'script':8A,48B,67C,82C,107C 'shape':33B,99C 'site':66C 'suppli':77C 'target':31B,97C 'text':29B,93C 'therefor':46B 'unescap':105C 'upload':20B 'viewer':109C 'vulner':68C 'without':38B 'write':27B 'writer':3A,72C","nicknames":[],"mitigations":[],"who_affected":"Applications that accept PPTX uploads from users and convert them to HTML with PHPPresentation 1.2.0 are exposed, because the attacker's file content ends up in pages other users view. Systems that only process trusted presentations, or that never use the HTML writer, can skip it. The sources do not give more detail on the affected configurations.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:18:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114404","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114404","severity":null,"published_at":"2026-10-21T13:18:31+00:00","modified_at":"2026-10-22T17:39:56+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114404","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114404","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}