CVE-2026-104140

Name	CVE-2026-104140
Description	QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
qgis (PTS)	bookworm	3.22.16+dfsg-1	vulnerable
	trixie	3.40.6+dfsg-1	vulnerable
	forky, sid	3.44.15+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
qgis	source	(unstable)	3.44.12+dfsg-1

Notes

https://github.com/qgis/QGIS/security/advisories/GHSA-cr49-pm9v-m788
https://github.com/qgis/QGIS/pull/66616
https://github.com/qgis/QGIS/pull/67044
Fixed by: https://github.com/qgis/QGIS/commit/1930e81c918818a4f5412219f8f7e470d2709f91
Fixed by: https://github.com/qgis/QGIS/commit/ca76fcac616dbf1c0446514fd6517296eb7c6904 (final-3_44_12)