CVE-2026-104140

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104140
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104140.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104140
Aliases
  • GHSA-cr49-pm9v-m788
Downstream
Published
2026-10-12T21:53:29Z
Modified
2026-10-28T02:30:29Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values
Details

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104140.json"
}
References

Affected packages

Git / github.com/qgis/qgis

Affected ranges

Type
GIT
Repo
https://github.com/qgis/qgis
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
916a9ec9ae76a51015061f4973de0447cf033035
Introduced
1ddcee3d0e439b1d89446cb09cef2b5faec1718b
Fixed
1930e81c918818a4f5412219f8f7e470d2709f91
Fixed
ca76fcac616dbf1c0446514fd6517296eb7c6904
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "3.44.12"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "last_affected": "4.2.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "1930e81c918818a4f5412219f8f7e470d2709f91"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "ca76fcac616dbf1c0446514fd6517296eb7c6904"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "final-3_44_12",
            "range": [
                {
                    "fixed": "916a9ec9ae76a51015061f4973de0447cf033035"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

Other
Before-merge-new_vector_api
final-1_8_0
final-3_44_0
final-3_44_1
final-3_44_10
final-3_44_11
final-3_44_2
final-3_44_3
final-3_44_4
final-3_44_5
final-3_44_6
final-3_44_7
final-3_44_8
final-3_44_9
ltr-3_44

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104140.json"