CVE-2026-114403: PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker needs a way to supply a crafted presentation file that is processed through IOFactory::load. The malicious file is a ZIP containing PhpPresentation.xml whose contents reach PHP unserialize().
What could exploitation allow an attacker to do?
The flaw can instantiate arbitrary PHP objects. Depending on available gadget chains, this can lead to code execution, file writes, or denial of service.
Which deployments should be considered affected?
Deployments using PHPOffice PHPPresentation through version 1.2.0 should be considered affected if they load attacker-controlled presentation files. The provided information does not identify a fixed version or a configuration-based workaround.