Skip to content
OpenAdvisories
Medium · 6.1 CVE-2026-104140 EUVD-2026-97977

QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values

Published Oct 12, 2026 · Updated Oct 13, 2026 · Assigned by GitHub_M

Vendor: qgis Product: QGIS Package: qgis Package: qgis Ecosystem: Debian Ecosystem: Ubuntu

Description

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.

Affected products

VendorProductAffectedFixed
qgis QGIS < 3.44.12, >= 4.0.0, <= 4.2.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 qgis 3.44.12+dfsg-1 —
Debian 13 qgis No fix yet —
Debian 12 qgis No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 qgis No fix yet —
Ubuntu 26.04 LTS qgis No fix yet —
Ubuntu 24.04 LTS qgis No fix yet —
Ubuntu 22.04 LTS qgis No fix yet —
Ubuntu 20.04 LTS qgis No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS qgis No fix yet —
Ubuntu 16.04 LTS qgis No fix yet —

References