CVE-2026-114403
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that…
- Risk score
- 72/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects. Attackers can execute code, write files, or cause a denial of service.
- Affected
- {'product': 'PHPOffice PHPPresentation', 'versions': '1.2.0'}
- Fix
- Check the linked advisory for a fix, as none is provided
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.1 high
- Remotely exploitable without logging in
- On your watchlist: php
References
- https://github.com/PHPOffice/PHPPresentation
- https://github.com/PHPOffice/PHPPresentation/blob/1.2.0/src/PhpPresentation/IOFactory.php#L39
- https://github.com/PHPOffice/PHPPresentation/blob/1.2.0/src/PhpPresentation/Reader/Serialized.php#L77-L109
- https://hackmd.io/@leediay/multiple_vulnerable_phppresentation
- https://www.vulncheck.com/advisories/phpoffice-phppresentation-through-1.2.0-deserialization-via-reader-serialized-load
Original description
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.
Last activity 21 Oct 2026. Patch Forecast updates every hour.