Executive Summary

CVE-2025-11184 is a stored Cross-Site Scripting (XSS) vulnerability in the QWC2 registration GUI of QGIS Web Client 2. It allows authorized users with editing permissions to inject arbitrary JavaScript code into the group description field. This malicious code is stored and later executed in the browsers of other users when they view the registration page. The root cause is improper handling of user input in the HTML template, specifically the use of the Jinja2 'safe' filter that disables automatic escaping, allowing HTML/JS injection. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with editing permissions to execute arbitrary JavaScript code in the browsers of other users who view the affected registration page. This can lead to session hijacking, theft of sensitive information, or other malicious actions performed in the context of the victim's browser session, potentially compromising user data and system integrity. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your QWC2 registration GUI version is prior to v2025.09.30 and by testing if the group description field allows injection of arbitrary JavaScript code. A practical test involves creating a registrable group with a description containing a script tag such as <script>alert(document.domain)</script> and then visiting the registration page to see if the script executes. There are no specific network commands provided, but verifying the version and testing the input sanitization in the registration GUI is recommended. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the QWC2 registration GUI to version v2025.09.30 or later, where the vulnerability is fixed by removing the unsafe use of the Jinja2 safe filter on user input. This update restores proper escaping of user input and prevents stored XSS attacks. [1]

Useful 0 Not Useful 0