CVE-2026-104140mediumCWE-79

CVE-2026-104140: medium-severity vulnerability in QGIS

QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values

Published · Updated

Follow this CVE+ Monitor QGIS+ Monitor qgis

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.2%
QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
qgis · QGIS
Related CVEs — QGIS

In the same product, most dangerous first.

CVE-2026-24480HIGHQGIS had validated RCE and Repository Takeover via GitHub ActionsEPSS 0.5%