CVE-2026-104140

MEDIUM 6.1

QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.

CWE	CWE-79
Vendor	qgis
Product	qgis
Published	Oct 12, 2026

Stay Ahead of the Next One

Get instant alerts for qgis qgis

Be the first to know when new medium vulnerabilities affecting qgis qgis are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

qgis / QGIS

< 3.44.12 >= 4.0.0, <= 4.2.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/qgis/QGIS/security/advisories/GHSA-cr49-pm9v-m788 github.com: https://github.com/qgis/QGIS/pull/66616 github.com: https://github.com/qgis/QGIS/pull/67044 github.com: https://github.com/qgis/QGIS/commit/1930e81c918818a4f5412219f8f7e470d2709f91 github.com: https://github.com/qgis/QGIS/commit/ca76fcac616dbf1c0446514fd6517296eb7c6904 github.com: https://github.com/qgis/QGIS/releases/tag/final-3_44_12