CVE-2026-114403 in PHPPresentation
Summary
by MITRE • 10/21/2026
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The PHPPresentation component within the PHPOffice library is designed to handle Microsoft PowerPoint presentations and other similar document formats by parsing their internal structures. In versions through 1.2.0, a critical security flaw exists in how the IOFactory::load method processes input files. This function acts as an entry point for loading presentation data from various file types, including ZIP archives which are commonly used to store PowerPoint presentations. The vulnerability arises because this method directly passes user-supplied content to PHP's unserialize() function without adequate validation or sanitization of the serialized object streams contained within the document structure.
This insecure deserialization flaw allows an attacker who can upload a maliciously crafted presentation file to execute arbitrary code on the server hosting the application using PHPOffice. By constructing a ZIP archive that contains a specifically designed PhpPresentation.xml file, an attacker can embed PHP serialized objects into the XML payload. When the vulnerable version of IOFactory::load processes this file, it attempts to deserialize these embedded objects. Because no restrictions are placed on which classes can be instantiated during deserialization, attackers can leverage known gadget chains—sequences of existing methods in the application or its dependencies—to trigger unintended side effects such as remote code execution, arbitrary file writes that could compromise system integrity, or denial of service conditions by exhausting server resources through complex object instantiation.
From a classification perspective, this vulnerability aligns with CWE-502 Deserialization of Untrusted Data and CWE-94 Improper Control of Generation of Code PHP Injection. The attack vector is typically classified under ATT&CK technique T1190 Exploit Public-Facing Application or T1059 Command and Scripting Interpreter if the deserialized objects lead to script execution. The impact extends beyond simple code execution; it can result in full system compromise depending on the privileges of the web server process, data exfiltration through file read operations enabled by gadget chains, or service disruption via resource exhaustion attacks leveraging complex object graphs that consume excessive memory during instantiation.
Mitigation strategies must focus on eliminating direct deserialization of untrusted input and implementing strict allowlists for permitted classes if serialization is unavoidable. Upgrading to a patched version of PHPOffice where this vulnerability has been addressed is the primary remediation step, as newer versions likely implement safer parsing mechanisms or restrict class instantiation during XML processing. Additionally, applications should enforce strict file type validation at upload time and avoid using generic parsers for untrusted documents unless they are explicitly designed with security boundaries against deserialization attacks. Implementing input validation that rejects serialized PHP objects within document payloads can provide an additional layer of defense while migration to secure alternatives is underway.