CVE-2025-11184
BaseFortify
Publication date: 2025-10-13
Last updated on: 2025-10-14
Assigner: Switzerland Government Common Vulnerability Program
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| qgis | qwc2 | 2025.03.31 |
| qgis | qwc2 | 2025.09.30 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-11184 is a stored Cross-Site Scripting (XSS) vulnerability in the QWC2 registration GUI of QGIS Web Client 2. It allows authorized users with editing permissions to inject arbitrary JavaScript code into the group description field. This malicious code is stored and later executed in the browsers of other users when they view the registration page. The root cause is improper handling of user input in the HTML template, specifically the use of the Jinja2 'safe' filter that disables automatic escaping, allowing HTML/JS injection. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with editing permissions to execute arbitrary JavaScript code in the browsers of other users who view the affected registration page. This can lead to session hijacking, theft of sensitive information, or other malicious actions performed in the context of the victim's browser session, potentially compromising user data and system integrity. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if your QWC2 registration GUI version is prior to v2025.09.30 and by testing if the group description field allows injection of arbitrary JavaScript code. A practical test involves creating a registrable group with a description containing a script tag such as <script>alert(document.domain)</script> and then visiting the registration page to see if the script executes. There are no specific network commands provided, but verifying the version and testing the input sanitization in the registration GUI is recommended. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the QWC2 registration GUI to version v2025.09.30 or later, where the vulnerability is fixed by removing the unsafe use of the Jinja2 safe filter on user input. This update restores proper escaping of user input and prevents stored XSS attacks. [1]