CVE-2026-104140

Received Received - Intake

Stored XSS in QGIS Server via WFS3 HTML Responses

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-104140

Affected Vendors & Products

Vendor	Product	Version / Range
qgis	QGIS	< 3.44.12
qgis	QGIS	>= 4.0.0, <= 4.2.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

QGIS Server before versions 3.44.12 and 4.0.0 through 4.2.3 has a vulnerability where feature data in WFS3 HTML responses is rendered without proper HTML escaping. Attacker-controlled values from a published vector layer can inject malicious scripts into HTML pages served by QGIS Server. When a user views these pages, the injected scripts execute in the QGIS Server context, potentially exposing session data or allowing unauthorized actions.

Detection Guidance

This vulnerability involves stored XSS in QGIS Server's WFS3 HTML responses. To detect it, inspect QGIS Server logs for unusual HTML responses containing feature.properties values. Check if published vector layers allow user-controlled input in feature properties. Review server responses for unescaped HTML content in getFeatures.html templates.

Impact Analysis

If you use a vulnerable QGIS Server version, an attacker could trick you into opening a crafted HTML page. This could lead to session hijacking, theft of sensitive data, or unauthorized actions performed on your behalf. The impact depends on your server's configuration and the privileges of the user account.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. A successful exploit may result in data breaches, triggering compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade QGIS Server to version 3.44.12 or later immediately. If upgrading is not possible, disable WFS3 HTML responses or restrict access to published writable vector layers. Monitor server logs for suspicious activity and review feature property inputs for malicious content.

Hi! I’m here to help you understand CVE-2026-104140. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70