Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104140— QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values

Quick assessment

Affected
qgis QGIS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

QGIS 是一款免费、开源的跨平台地理信息系统。在版本 3.44.12 之前，以及 4.0.0 至 4.2.3 版本中，QGIS Server 在向 WFS3（OGC API Features）的 HTML 响应中渲染要素数据时，未进行 HTML 转义处理。来自已发布的可写矢量图层（writable vector layer）的、由攻击者控制的 值，会通过 函数及 回调，被传递至 。当用户打开包含恶意内容的 HTML 页面时，便可在 QGIS Server 的上下文中执行预存的标记语言或脚本，从而可能泄露浏览者的会

CVSS 6.1 · Medium EPSS 0.20% · P9

Affected Version Matrix 2

VendorProduct Version RangeStatus
qgis QGIS < 3.44.12 affected
>= 4.0.0, <= 4.2.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104140

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values
Source: CVE Program / CVE List V5
Vulnerability Description
QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
qgis QGIS < 3.44.12 -

II. Public POCs for CVE-2026-104140

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104140

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-104140 (4)

Vendor Advisories for CVE-2026-104140 (1)

Vendor Pages for CVE-2026-104140 (1)

IV. Related Vulnerabilities

Same product: QGIS
Same vendor: qgis
Same weakness: CWE-79

V. Comments for CVE-2026-104140

No comments yet

Leave a comment