PHPOffice PHPPresentation CVE-2026-114404

Exploitation requires that a target application (1) processes attacker-influenced presentation content through PHPPresentation 1.2.0's HTML writer (Writer/HTML.php), and (2) renders that generated HTML to a victim's browser. The concrete injection vectors are PPTX text runs, hyperlink relationship (r:id) targets, and shape descr attributes, which are emitted without HTML/attribute escaping. Limiting factors: the attacker must be able to supply or influence the presentation content, the application must actually use the HTML writer on that untrusted content, and - per UI:P in the CVSS vector - a victim must passively view the resulting HTML for the script to fire. Applications that do not expose PHPPresentation's HTML output to users, or that sanitize it downstream, are not exposed.

This is a medium-severity stored/reflected XSS (CWE-79) in a software library, not an internet-facing service, so real-world risk is bounded and context-dependent. The provided CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, 5.3 Medium) correctly models the flaw: network vector but no impact to the vulnerable system itself (VC/VI/VA:N) and only limited confidentiality/integrity impact to a subsequent system - the victim's browser (SC:L/SI:L). Passive user interaction (UI:P) is required: a victim must view the HTML output generated from attacker-supplied presentation content, which meaningfully constrains exploitation. No EPSS score was provided, this CVE is NOT in CISA KEV, and no public exploit flag was set in the input, so there is no signal of active or widespread exploitation. A technical write-up (hackmd) and a VulnCheck advisory exist with vulnerable source-line references, raising the practical likelihood that working XSS payloads are documented, but that is distinct from confirmed exploitation. Net: a legitimate issue to patch for applications that render PHPPresentation HTML output from untrusted uploads, but it is a medium-risk, interaction-dependent client-side bug rather than a high-urgency, auto-exploitable server compromise.

An application lets users upload PPTX files and uses PHPPresentation 1.2.0's HTML writer to render previews. An attacker uploads a presentation whose text runs, hyperlink targets, or shape descr attributes contain a script payload; because these are emitted unescaped, the script executes in the browser of any user (e.g. an admin or reviewer) who views the generated HTML preview. A public technical write-up and VulnCheck advisory describe the vulnerable code paths, but no weaponized exploit was flagged in the input.