PHPOffice PHPPresentation CVE-2026-114403

Exploitation requires that the target application call PHPPresentation's IOFactory::load() on an attacker-controllable file, and that the crafted file be a ZIP whose contents cause routing to the Serialized reader (a PhpPresentation.xml payload handed to unserialize() in Reader/Serialized.php). The practical escalation from object instantiation to code execution or file write further requires a usable PHP gadget chain present in the application or its loaded dependencies - without such a chain the realistic outcome is limited to arbitrary object instantiation or denial of service. Limiting factors: the vulnerable serialized-reader path must be reachable (applications that only read standard PowerPoint/ODP formats may not invoke it), and full RCE impact is contingent on available gadgets, which is why the authoritative vector marks AT:P (attack requirement present) rather than a fully unconditional network exploit.

This is a genuine high-priority vulnerability, though its severity is conditional rather than automatic. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H, 9.2) indicates unauthenticated network-reachable exploitation with full impact to confidentiality, integrity, and availability - consistent with a CWE-502 insecure deserialization flaw reaching unserialize(). The critical qualifier is AT:P (attack requirement present): exploitation is not turnkey because it depends on the consuming application actually routing an attacker-supplied file to IOFactory::load AND the presence of a usable PHP gadget chain in the target's codebase/dependencies, without which the primitive yields only object instantiation or denial of service rather than guaranteed RCE. No EPSS score, KEV listing, or POC flag was supplied in the input, so exploitation-probability signals are absent; absence of these is not evidence of low risk. A detailed third-party technical writeup (hackmd) and a VulnCheck advisory exist and pinpoint the vulnerable Serialized.php reader, meaning the vulnerability mechanics are public and reproducible even if no packaged exploit is confirmed. Net: treat as a real priority for any application that ingests user-supplied presentation files via PHPPresentation, but recognize the practical blast radius is gated by whether the deserialized data path is actually exposed and whether gadget chains are available.

An application uses PHPPresentation's IOFactory::load() to process user-uploaded presentation files. An attacker uploads a crafted ZIP containing a PhpPresentation.xml that the Serialized reader passes to unserialize(), instantiating arbitrary PHP objects; if a suitable gadget chain exists in the application or its dependencies, this escalates to arbitrary code execution, arbitrary file writes, or denial of service. No packaged public exploit is confirmed in the input, but a public technical writeup documents the vulnerable code path.