PHPOffice PHPPresentation versions up to 1.2.0 contain an insecure deserialization flaw that allows an attacker to supply a crafted presentation file containing a ZIP archive with a malicious PhpPresentation.xml. The IOFactory::load routine passes this XML data to PHP's unserialize() function, permitting instantiation of arbitrary PHP objects through gadget chains. The impact of a successful exploit is the ability for the attacker to execute code with the privileges of the web application, write files to the server, or cause a denial of service by corrupting internal state.

The affected product is PHPOffice PHPPresentation versions up to and including 1.2.0. Any deployment that accepts user‑uploaded presentation files and processes them with Reader\Serialized::load is vulnerable.

The CVSS score of 9.2 indicates a high severity vulnerability with full remote code execution potential. The EPSS score is currently unavailable, but the lack of a KEV listing does not reduce the immediate risk, as evidence and community advisories highlight the ease of exploitation through standard file upload vectors. Based on the description, the likely attack vector is a direct upload of a malicious ZIP payload to the application, which triggers unserialize() and enables gadget chain execution. The exploit is straightforward for an attacker who can supply an arbitrary file to the upload endpoint.