CVE-2026-104140

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104140
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104140.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104140
Aliases
  • GHSA-cr49-pm9v-m788
Downstream
Published
2026-10-12T21:53:29Z
Modified
2026-10-14T02:46:03Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values
Details

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104140.json"
}
References

Affected packages

Git / github.com/qgis/qgis

Affected ranges

Type
GIT
Repo
https://github.com/qgis/qgis
Events
Introduced
1ddcee3d0e439b1d89446cb09cef2b5faec1718b
Fixed
b041a18904a4dc9fdada8ecb2c84385054ddfee1
Fixed
1930e81c918818a4f5412219f8f7e470d2709f91
Fixed
ca76fcac616dbf1c0446514fd6517296eb7c6904
Fixed
916a9ec9ae76a51015061f4973de0447cf033035
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "4.0.0"
        },
        {
            "fixed":  "4.2.3"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104140.json"