CVE-2026-104140
mediumQGIS is a free, open source, cross-platform geographic information system.
QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/qgis/QGIS/commit/1930e81c918818a4f5412219f8f7e470d2709f91 security-advisories@github.com
- https://github.com/qgis/QGIS/commit/ca76fcac616dbf1c0446514fd6517296eb7c6904 security-advisories@github.com
- https://github.com/qgis/QGIS/pull/66616 security-advisories@github.com
- https://github.com/qgis/QGIS/pull/67044 security-advisories@github.com
- https://github.com/qgis/QGIS/releases/tag/final-3_44_12 security-advisories@github.com
- https://github.com/qgis/QGIS/security/advisories/GHSA-cr49-pm9v-m788 security-advisories@github.com
- https://github.com/qgis/QGIS/security/advisories/GHSA-cr49-pm9v-m788 134c704f-9b21-4f2e-91b3-4a467353bcc0