PHPPresentation flaws (CVE-2026-114403/114404): a slide deck that runs code

What happened

On 21 October 2026, two CVEs landed for PHPOffice PHPPresentation through 1.2.0: CVE-2026-114403, an insecure deserialization flaw, and CVE-2026-114404, a cross-site scripting flaw in the HTML writer. An attacker uploads a ZIP containing a crafted PhpPresentation.xml; IOFactory::load() passes it to unserialize(), instantiating arbitrary PHP objects. The XSS then fires when the generated deck is viewed.

Any application that converts user-uploaded presentations — document portals, reporting tools, e-learning attachments — and bundles this library is exposed by upload alone.

Impact

Deserialization to object instantiation is the standard prelude to remote code execution via gadget chains, and the stored XSS compromises every admin who previews the file. For B2B portals that accept supplier uploads, one crafted deck can take both the server and the reviewing staff.

Root cause in one paragraph

The file reader trusted the archive's contents as its own configuration language and deserialized embedded objects instead of parsing plain data; the HTML writer then echoed attacker text without encoding — two trust errors in one upload path.

What to do now

• No fixed release exists yet (1.2.0 is still the latest upstream) — until one ships, treat every presentation upload as hostile: disable the upload path if possible, or sandbox conversion in an isolated worker with no credentials.
• Validate uploads by content sniffing, not extension; store them outside the web root.
• Render user-influenced output through an encoder (the HTML writer must escape text nodes and attributes).
• Scan for unexpected PHP objects or admin sessions around any instance that accepted uploads while vulnerable.
• Inventory which of your apps bundle PHPOffice libraries — Spreadsheet and Word cousins deserve the same review.

What this means for Magento stores

Magento imports supplier spreadsheets and product feeds constantly, and custom modules love PHPOffice for parsing them. The same crafted-file-to-unserialize shape applies to XLSX/CSV importers: parse uploads as data (read cell values, never object graphs), run imports in a sandboxed queue worker, and encode everything before it reaches the admin grid.

Sources

• NVD: CVE-2026-114403, CVE-2026-114404

Next in this series: GitLab October security release (12 CVEs) — /blog/cve-2026-gitlab-october-release