Log in Start free

Vulnerability · Published Oct 12, 2026 · Assigned by GitHub_M

CVE-2026-104140QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values

Medium 6.1

In plain English

A medium-severity cross-site scripting in QGIS from qgis. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.2%top 84.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12qgisno fix listedDEBIAN-CVE-2026-104140
Debian:13qgisno fix listedDEBIAN-CVE-2026-104140
Debian:14qgis3.44.12+dfsg-1DEBIAN-CVE-2026-104140
Ubuntu:22.04:LTSqgisno fix listedUBUNTU-CVE-2026-104140
Ubuntu:24.04:LTSqgisno fix listedUBUNTU-CVE-2026-104140
Ubuntu:26.04:LTSqgisno fix listedUBUNTU-CVE-2026-104140
Ubuntu:26.10qgisno fix listedUBUNTU-CVE-2026-104140

Affected products (as reported)

VendorProductVersions
qgis QGIS < 3.44.12>= 4.0.0, <= 4.2.3

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References