CVE-2026-114404: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in PHPOffice PHPPresentation

CVE-2026-114404 is a cross-site scripting vulnerability in PHPOffice PHPPresentation 1.2.0. The vulnerability arises from improper neutralization of input during web page generation in the HTML writer. Attackers can supply malicious presentation content, such as crafted PPTX files containing malicious text runs, hyperlink relationship targets, or shape description attributes that are emitted without proper escaping. This results in script execution in the context of the viewer's browser when the HTML is rendered.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the user's browser when viewing the generated HTML presentations. This can lead to typical XSS impacts such as session hijacking, defacement, or redirection to malicious sites. The CVSS 4.0 base score is 5.3, indicating a medium severity vulnerability with network attack vector, low attack complexity, no privileges required, user interaction required, and low scope impact.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid processing untrusted PPTX files with PHPPresentation's HTML writer or sanitize inputs before generating HTML output to mitigate injection risks.