CVE-2026-104140: QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values
QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the ifnullptrnullstr callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
QGIS Serverto a version that resolves this vulnerability.Fixed in 3.44.12
Event History
Frequently Asked Questions
Who is exposed to this issue?
QGIS Server deployments that publish a writable vector layer through WFS3/OGC API Features are exposed if users can view the HTML items page. The attacker-controlled content must be stored in feature.properties values in that published layer.
What must an attacker do to exploit it?
An attacker needs to place markup or script in a feature attribute value and have a user open the corresponding WFS3 getFeatures HTML page. No attacker authentication is indicated, but exploitation requires the attacker to be able to control data in a published writable vector layer.
What is the impact on a user who visits the affected page?
Stored script or markup can execute in the QGIS Server origin in the viewer's browser. This can expose the viewer's session data or send authenticated requests with that viewer's privileges.
Which versions are affected and what is the remediation?
Versions before 3.44.12 and versions from 4.0.0 through 4.2.3 are affected. Upgrade to QGIS 3.44.12; the provided data identifies it as the fixed version.