CVE-2026-114404: PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attributes that are emitted unescaped, executing script in viewers' browsers.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using PHPOffice PHPPresentation 1.2.0 to convert or publish attacker-supplied presentation content as HTML are exposed. Browser users who view the generated HTML may have attacker-controlled script execute in their browser.
What must an attacker provide to exploit it?
The attacker must be able to supply presentation content that is processed by the HTML writer and later viewed as generated HTML. Malicious content can be placed in text runs, hyperlink relationship targets, or shape description attributes.
Is user interaction required?
Yes. A user must view the generated HTML in a browser for the injected script to execute.