External risk intelligence

PHPPresentation Deserialization Vulnerability Allows Object Instantiation

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-114403

PHPPresentation is a software library integrated into applications rather than a standalone network-facing service. While it may be used in web applications that accept user-uploaded files, exposure depends entirely on the specific application's implementation and whether it allows users to upload files processed by this library. It is not inherently internet-facing by design.

Deserialization

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in a software library used for handling presentations. The issue allows an attacker to execute code or cause system disruptions by submitting a specially crafted file, potentially leading to unauthorized actions on affected systems. The primary concern is to confirm if this library is in use and if the affected functionality is exposed.

A flaw allows malicious files to run code.
It impacts systems processing presentation files.
Confirm relevance and check for exposure.

Attack Path

How an attacker could exploit the issue

An attacker can achieve arbitrary code execution by uploading a specially crafted presentation file to an application that uses the vulnerable library. This file, when processed by the `IOFactory::load` function, can be passed to `unserialize()`, triggering a deserialization vulnerability. Successful exploitation could lead to the attacker executing commands on the server, modifying files, or causing a denial of service.

No authentication or privileges needed.
Uploading a crafted presentation file.
Arbitrary code execution and data corruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the integrity and availability of applications that process presentation files. When a specially crafted ZIP file containing a specific XML file is processed, the application may instantiate arbitrary PHP objects, potentially leading to unauthorized code execution or denial of service.

Application integrity and availability.
Processing malicious presentation files.
Arbitrary code execution or DoS.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects applications using the PHPPresentation library for file processing. The first step is to identify all instances of this library within your environment, determine their reachability and business criticality, and locate the accountable owner for each instance. Subsequent remediation planning should be risk-based, considering factors like exposure, criticality, and available maintenance windows.

Application owners should manage the issue.
Verify library usage and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the PHPOffice PHPPresentation library?

PHPPresentation is a PHP library designed for developers to create, read, and manipulate presentation documents like PowerPoint files programmatically. It is commonly integrated into web applications to enable features such as dynamic report generation, slide deck exporting, or document management systems. Because it serves as a background component, it does not run as a standalone server but operates within the logic of the host application.

What does CWE-502 deserialization mean for CVE-2026-114403?

CWE-502 refers to Deserialization of Untrusted Data. In this vulnerability, the library takes serialized data from an uploaded file and reconstructs it into a PHP object without proper validation. By crafting this data, an attacker can trick the system into creating unauthorized objects, which can trigger a chain of malicious actions, such as executing arbitrary commands on the server or corrupting system files.

How does an attacker trigger this vulnerability?

The flaw is triggered when an application uses the library's IOFactory::load function to process a malicious file. The attacker must supply a specifically crafted ZIP file containing a malformed PhpPresentation.xml. If the application does not process user-uploaded files or use this specific loading function, the attack path is not present. Simply having the library installed in a codebase is not enough to trigger the code execution on its own.

Is my application at risk according to Halo Surface Signal?

Halo Surface Signal indicates that PHPPresentation is a library, not a standalone service, so risk is not universal. Whether you are at risk depends on if your specific application allows users to upload files that are then processed by this library. Since the library itself is not inherently internet-facing, you should focus on applications where file upload functionality is available to users.

How should I respond to this vulnerability?

Begin by identifying all applications in your environment that rely on the PHPPresentation library. Once you have a list, verify which ones allow users to upload files, as these are your highest priority. Coordinate with the owners of those specific applications to assess their business criticality and evaluate the need for updates or alternative processing methods to mitigate the risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.