CVE-2026-114403

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.

This vulnerability can lead to remote code execution in the context of the application processing uploaded files, potentially resulting in full server compromise or data loss. Organizations accepting presentation files from users are particularly at risk.

Update PHPOffice PHPPresentation to a version later than 1.2.0 if available, or implement additional validation of uploaded files and avoid deserializing untrusted data. Consider restricting the ability to upload presentation files from untrusted users.