PHPOffice PHPPresentation: Insecure deserialization via crafted presentation file
Summary
PHPPresentation, a PHP library for reading and writing presentation files, deserializes data from the uploaded file with PHP's unserialize() function. An attacker can supply a crafted file, for example a ZIP archive containing PhpPresentation.xml, that is loaded through IOFactory::load or the Serialized reader. This can lead to code execution through gadget chains, arbitrary file writes or denial of service. Exposure is highest in web applications that accept presentation uploads from untrusted users.
Affected
- PHPOffice PHPPresentation 0 to 1.2.0 (Composer package phpoffice/phppresentation)
Fixed in
- Unverified. One aggregator states that version 1.3.0 or later removes the vulnerable Reader\Serialized::load code path. No vendor advisory was found, so check the releases page before relying on this.
- Pull request #1038 proposes a code fix. Its merge status is unknown.
Workaround
- No vendor workaround found.
- Do not pass uploaded presentations to PHPPresentation readers, including IOFactory::load, until the library is upgraded and verified.
- Restrict public upload endpoints and require authentication.
- Run document processing in an isolated container or sandbox with minimal file-system and network access.
Exploitation
- CISA KEV: not listed.
- CISA SSVC: exploitation status 'poc', automatable: no, technical impact: total.
- A public write-up with proof-of-concept details exists for this CVE and CVE-2026-114404.
- EPSS: about 0.48% probability of exploitation in the next 30 days.
- Active exploitation in the wild: unknown.
Our recommendation
- Inventory all Composer projects that use phpoffice/phppresentation and identify the installed version.
- Treat versions up to and including 1.2.0 as vulnerable. Upgrade to a release confirmed as fixed on the vendor's releases page.
- Until patched, disable processing of untrusted presentation uploads or restrict them to authenticated, trusted users.
- Also patch CVE-2026-114404 (cross-site scripting in the HTML writer) at the same time.
- Monitor upload and conversion logs for unusual errors or crashes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- PHPPresentation GitHub repository github.com
- VulnCheck advisory for PHPPresentation deserialization www.vulncheck.com
- Technical write-up (HackMD) hackmd.io
- IOFactory.php at 1.2.0 github.com
- Reader/Serialized.php at 1.2.0 github.com
- Pull request #1038 (proposed fix) github.com
- PHPPresentation releases github.com
- OpenCVE entry for CVE-2026-114403 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:08.
Original description (NVD)
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.
NVD references (6)
- https://github.com/PHPOffice/PHPPresentation
- https://github.com/PHPOffice/PHPPresentation/blob/1.2.0/src/PhpPresentation/IOFactory.php#L39
- https://github.com/PHPOffice/PHPPresentation/blob/1.2.0/src/PhpPresentation/Reader/Serialized.php#L77-L109
- https://hackmd.io/@leediay/multiple_vulnerable_phppresentation
- https://www.vulncheck.com/advisories/phpoffice-phppresentation-through-1.2.0-deserialization-via-reader-seria…
- https://hackmd.io/@leediay/multiple_vulnerable_phppresentation
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.