CVE-2026-104140 in QGIS
Summary
by MITRE • 10/13/2026
QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
QGIS serves as a prominent free and open-source geographic information system utilized globally for mapping and spatial analysis. Within this ecosystem, QGIS Server provides web services to expose geospatial data via standard protocols such as the OGC API Features, commonly known as WFS3. A critical security flaw was identified in versions prior to 3.44.12 and within the range of 4.0.0 through 4.2.3 regarding how these server-side HTML responses are generated. The vulnerability stems from a failure to properly sanitize user-supplied input before rendering it into Hypertext Markup Language, specifically affecting the handling of feature properties in writable vector layers published via QGIS Server.
The technical root cause lies within the QgsServerOgcApiHandler component, which processes requests for feature data and routes them through an HTML template located at resources/server/api/ogc/templates/wfs3/getFeatures.html. When a client requests features from a writable layer, the server retrieves property values associated with those features. These values are passed to an htmlDump function along with an if_nullptr_null_str callback. Crucially, this process does not apply HTML escaping or encoding to the feature properties before they are inserted into the response body. This omission allows any special characters contained within the attribute data to be interpreted as executable code by the client's web browser rather than being displayed as plain text.
This architectural flaw results in a Stored Cross-Site Scripting vulnerability, classified under CWE-79: Improper Neutralization of Input During Web Page Generation. Because the unescaped content is stored on the server and subsequently served to any user who accesses the specific endpoint or views the affected items page, the malicious script persists until the underlying data is modified or removed. An attacker with write access to a published vector layer can inject arbitrary JavaScript code into feature properties. When another user opens an HTML page displaying these features in a web browser that supports QGIS Server interactions, the embedded scripts execute within the context of the QGIS Server origin.
The operational impact of this vulnerability is significant due to its stored nature and potential for session hijacking or privilege escalation. Since the malicious script executes with the privileges of the victim user, an attacker can access sensitive session data such as authentication tokens, cookies, or local storage contents. Furthermore, the attacker can issue authenticated requests on behalf of the victim, effectively impersonating them within the QGIS Server environment. This capability allows for unauthorized modifications to geospatial data, exfiltration of confidential spatial information, or further exploitation of other vulnerabilities that require valid user authentication. The risk is heightened because it targets users who are already authorized to interact with the system, making traditional perimeter defenses less effective against this insider-like threat vector.
To mitigate this vulnerability, organizations must immediately upgrade QGIS Server to version 3.44.12 or later, where the issue has been resolved by implementing proper input encoding and output escaping mechanisms. For environments unable to patch immediately, administrative controls should be enforced to restrict write access to vector layers that are exposed via WFS3 HTML endpoints. Additionally, deploying a Web Application Firewall with rules capable of detecting and blocking cross-site scripting payloads in HTTP responses can provide an additional layer of defense. Security teams should also audit existing published layers for any previously injected malicious scripts and ensure that Content Security Policy headers are configured to restrict script execution origins where feasible. This incident underscores the importance of rigorous input validation and output encoding in all web-facing components of geographic information systems, aligning with ATT&CK techniques related to client-side injection and session manipulation.