medium6.1
CVE-2026-114404
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to injec…
Impact
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attributes that are emitted unescaped, executing script in viewers' browsers.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/PHPOffice/PHPPresentation
- https://github.com/PHPOffice/PHPPresentation/blob/1.2.0/src/PhpPresentation/Writer/HTML.php#L307-L330
- https://hackmd.io/@leediay/multiple_vulnerable_phppresentation
- https://www.vulncheck.com/advisories/phppresentation-1.2.0-xss-via-writer-html-text-runs-hyperlinks-and-descriptions