DEBIAN-CVE-2026-104140

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-104140

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-104140.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-104140

Upstream

CVE-2026-104140

Published

2026-10-12T22:17:03Z

Modified

2026-10-14T09:47:33Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.

References

https://security-tracker.debian.org/tracker/CVE-2026-104140

Affected packages

Debian:12 / qgis

Package

Name: qgis
Purl: pkg:deb/debian/qgis?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.22.16+dfsg-1

3.28.4+dfsg-1~exp1

3.28.5+dfsg-1~exp1

3.28.6+dfsg-1~exp1

3.28.7+dfsg-1~exp1

3.28.7+dfsg-1

3.28.8+dfsg-1~bpo12+1

3.28.8+dfsg-1~exp1

3.28.8+dfsg-1

3.28.9+dfsg-1~bpo11+1

3.28.9+dfsg-1~bpo12+1

3.28.9+dfsg-1~exp1

3.28.9+dfsg-1

3.28.10+dfsg-1~bpo12+1

3.28.10+dfsg-1~exp1

3.28.10+dfsg-1

3.28.11+dfsg-1~bpo12+1

3.28.11+dfsg-1~exp1

3.28.11+dfsg-1

3.28.11+dfsg-2

3.28.12+dfsg-1~bpo12+1

3.28.12+dfsg-1~exp1

3.28.12+dfsg-1

3.28.13+dfsg-1~bpo12+1

3.28.13+dfsg-1~exp1

3.28.13+dfsg-1

3.28.14+dfsg-1~bpo12+1

3.28.14+dfsg-1~exp1

3.28.14+dfsg-1

3.28.15+dfsg-1~bpo12+1

3.28.15+dfsg-1~exp1

3.28.15+dfsg-1

3.28.15+dfsg-1.1~exp1

3.28.15+dfsg-2~exp1

3.34.4+dfsg-1~exp1

3.34.4+dfsg-1

3.34.4+dfsg-2~exp1

3.34.4+dfsg-2

3.34.4+dfsg-3

3.34.4+dfsg-4

3.34.5+dfsg-1~exp1

3.34.5+dfsg-1

3.34.6+dfsg-1~bpo12+1

3.34.6+dfsg-1~exp1

3.34.6+dfsg-1

3.34.7+dfsg-1~bpo12+1

3.34.7+dfsg-1~exp1

3.34.7+dfsg-1

3.34.8+dfsg-1~bpo12+1

3.34.8+dfsg-1~exp1

3.34.8+dfsg-1

3.34.9+dfsg-1~exp1

3.34.9+dfsg-1

3.34.9+dfsg-2

3.34.10+dfsg-1~bpo12+1

3.34.10+dfsg-1~exp1

3.34.10+dfsg-1

3.34.11+dfsg-1~bpo12+1

3.34.11+dfsg-1~exp1

3.34.11+dfsg-1

3.34.12+dfsg-1~bpo12+1

3.34.12+dfsg-1~exp1

3.34.12+dfsg-1

3.34.13+dfsg-1~bpo12+1

3.34.13+dfsg-1~exp1

3.34.13+dfsg-1

3.34.14+dfsg-1~bpo12+1

3.34.14+dfsg-1~exp1

3.34.14+dfsg-1

3.34.15+dfsg-1~bpo12+1

3.34.15+dfsg-1~exp1

3.34.15+dfsg-1

3.34.15+dfsg-2

3.40.4+dfsg-1~exp1

3.40.4+dfsg-1

3.40.4+dfsg-2

3.40.4+dfsg-3~bpo12+1

3.40.4+dfsg-3

3.40.5+dfsg-1~bpo12+1

3.40.5+dfsg-1~exp1

3.40.5+dfsg-1

3.40.6+dfsg-1~bpo12+1

3.40.6+dfsg-1~exp1

3.40.6+dfsg-1

3.40.7+dfsg-1~exp1

3.40.8+dfsg-1~exp1

3.40.9+dfsg-1~exp1

3.40.9+dfsg-1

3.40.10+dfsg-1~bpo13+1

3.40.10+dfsg-1~exp1

3.40.10+dfsg-1

3.40.11+dfsg-1~bpo13+1

3.40.11+dfsg-1

3.40.12+dfsg-1~bpo13+1

3.40.12+dfsg-1

3.40.13+dfsg-1

3.40.13+dfsg-2~bpo13+1

3.40.13+dfsg-2

3.40.14+dfsg-1~bpo13+1

3.40.14+dfsg-1

3.40.15+dfsg-1~bpo13+1

3.40.15+dfsg-1

3.44.8+dfsg-1~bpo13+1

3.44.8+dfsg-1~exp1

3.44.8+dfsg-1

3.44.9+dfsg-1~bpo13+1

3.44.9+dfsg-1~exp1

3.44.9+dfsg-1

3.44.10+dfsg-1~exp1

3.44.10+dfsg-1

3.44.10+dfsg-2~bpo13+1

3.44.10+dfsg-2

3.44.11+dfsg-1~bpo13+1

3.44.11+dfsg-1~exp1

3.44.11+dfsg-1

3.44.12+dfsg-1~bpo13+1

3.44.12+dfsg-1~exp1

3.44.12+dfsg-1

3.44.13+dfsg-1~bpo13+1

3.44.13+dfsg-1~exp1

3.44.13+dfsg-1

3.44.13+dfsg-2

3.44.13+dfsg-3

3.44.14+dfsg-1~bpo13+1

3.44.14+dfsg-1~exp1

3.44.14+dfsg-1

3.44.15+dfsg-1~bpo13+1

3.44.15+dfsg-1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-104140.json"

Debian:13 / qgis

Package

Name: qgis
Purl: pkg:deb/debian/qgis?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.40.6+dfsg-1

3.40.7+dfsg-1~exp1

3.40.8+dfsg-1~exp1

3.40.9+dfsg-1~exp1

3.40.9+dfsg-1

3.40.10+dfsg-1~bpo13+1

3.40.10+dfsg-1~exp1

3.40.10+dfsg-1

3.40.11+dfsg-1~bpo13+1

3.40.11+dfsg-1

3.40.12+dfsg-1~bpo13+1

3.40.12+dfsg-1

3.40.13+dfsg-1

3.40.13+dfsg-2~bpo13+1

3.40.13+dfsg-2

3.40.14+dfsg-1~bpo13+1

3.40.14+dfsg-1

3.40.15+dfsg-1~bpo13+1

3.40.15+dfsg-1

3.44.8+dfsg-1~bpo13+1

3.44.8+dfsg-1~exp1

3.44.8+dfsg-1

3.44.9+dfsg-1~bpo13+1

3.44.9+dfsg-1~exp1

3.44.9+dfsg-1

3.44.10+dfsg-1~exp1

3.44.10+dfsg-1

3.44.10+dfsg-2~bpo13+1

3.44.10+dfsg-2

3.44.11+dfsg-1~bpo13+1

3.44.11+dfsg-1~exp1

3.44.11+dfsg-1

3.44.12+dfsg-1~bpo13+1

3.44.12+dfsg-1~exp1

3.44.12+dfsg-1

3.44.13+dfsg-1~bpo13+1

3.44.13+dfsg-1~exp1

3.44.13+dfsg-1

3.44.13+dfsg-2

3.44.13+dfsg-3

3.44.14+dfsg-1~bpo13+1

3.44.14+dfsg-1~exp1

3.44.14+dfsg-1

3.44.15+dfsg-1~bpo13+1

3.44.15+dfsg-1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-104140.json"

Debian:14 / qgis

Package

Name: qgis
Purl: pkg:deb/debian/qgis?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.44.12+dfsg-1

Affected versions

3.*

3.40.6+dfsg-1

3.40.7+dfsg-1~exp1

3.40.8+dfsg-1~exp1

3.40.9+dfsg-1~exp1

3.40.9+dfsg-1

3.40.10+dfsg-1~bpo13+1

3.40.10+dfsg-1~exp1

3.40.10+dfsg-1

3.40.11+dfsg-1~bpo13+1

3.40.11+dfsg-1

3.40.12+dfsg-1~bpo13+1

3.40.12+dfsg-1

3.40.13+dfsg-1

3.40.13+dfsg-2~bpo13+1

3.40.13+dfsg-2

3.40.14+dfsg-1~bpo13+1

3.40.14+dfsg-1

3.40.15+dfsg-1~bpo13+1

3.40.15+dfsg-1

3.44.8+dfsg-1~bpo13+1

3.44.8+dfsg-1~exp1

3.44.8+dfsg-1

3.44.9+dfsg-1~bpo13+1

3.44.9+dfsg-1~exp1

3.44.9+dfsg-1

3.44.10+dfsg-1~exp1

3.44.10+dfsg-1

3.44.10+dfsg-2~bpo13+1

3.44.10+dfsg-2

3.44.11+dfsg-1~bpo13+1

3.44.11+dfsg-1~exp1

3.44.11+dfsg-1

3.44.12+dfsg-1~bpo13+1

3.44.12+dfsg-1~exp1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-104140.json"