CVE-2026-114404

MediumCVSS 6.1

Published: 21/10/2026(UTC)Updated: 22/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attributes that are emitted unescaped, executing script in viewers' browsers.

Risk Assessment

This can lead to execution of arbitrary JavaScript in the browser of a user viewing the generated HTML, potentially resulting in session or data theft. The risk affects applications that convert untrusted PPTX files to HTML.

Recommendation

Upgrade PHPOffice PHPPresentation to a version containing the fix. Additionally, sanitize presentation content and escape output in the generated HTML.

Other vulnerabilities in PHPOffice PHPPresentation

CVE-2026-114403High
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS