CVE-2026-114403— PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load
Quick assessment
Affected
PHPOffice PHPPresentation
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PHPOffice PHPPresentation 1.2.0 及更早版本存在不安全的反序列化漏洞。攻击者可通过提供精心构造的演示文稿文件，实例化任意 PHP 对象。具体而言，攻击者可上传一个包含 的 ZIP 文件，该文件会被 方法传递给 函数，从而触发利用链（gadget chain），实现代码执行、文件写入或拒绝服务攻击。
Possible ATT&CK Techniques 3 AI
T1562 T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114403
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load
Source: CVE Program / CVE List V5
Vulnerability Description
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PHPOffice | PHPPresentation | 0 ~ 1.2.0 | - |
|
II. Public POCs for CVE-2026-114403
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114403
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-114403 (1)
Proof of Concept for CVE-2026-114403 (1)
Vendor Pages for CVE-2026-114403 (1)
Other References for CVE-2026-114403 (1)
Other References for CVE-2026-114403 (1)
-
https://hackmd.io/@leediay/multiple_vulnerable_phppresentation third-party-advisory
IV. Related Vulnerabilities
Same vendor: PHPOffice
-
CVE-2026-114404
PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperli -
CVE-2026-59932
PhpSpreadsheet: Gnumeric reader unbounded gzip expansion cau -
CVE-2026-59933
PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory -
CVE-2026-59931
PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE( -
CVE-2026-45034
PhpSpreadsheet: File::prohibitWrappers bypass
Same weakness: CWE-502
-
CVE-2026-113779
pfSense REST API package Vulnerable to Privilege Escalation -
CVE-2026-110370
WordPress GS Pins for Pinterest plugin <= 1.9.2 - PHP Object -
CVE-2026-110369
WordPress WordPress Team Members – GS Plugins plugin <= 2.8. -
CVE-2026-82814
Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthen -
CVE-2026-114198
Deserialization of untrusted data in floss
V. Comments for CVE-2026-114403
No comments yet