All vulnerabilities
CVE-2026-104140GHSA-cr49-pm9v-m788

QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values

qgis QGIS
Open in ThreatlineRecord JSON
CVSS
6.1Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 13 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published12 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.

Text from CVE List

Affected versions 3

  • QGISaffected: < 3.44.12CVE List
  • QGISaffected: >= 4.0.0, <= 4.2.3CVE List
  • QGIS<= 4.0.3GitHub

References 6