Improper Input Validation in QGIS Server Leading to Code Injection
CVE-2026-104140

6.1MEDIUM

Key Information:

Vendor

Qgis

Status
Qgis
Vendor
CVE Published:
12 October 2026

What is CVE-2026-104140?

The QGIS Server, which is an open-source GIS tool, suffers from a vulnerability that arises from improper handling of feature data in WFS3 HTML responses. Specifically, prior to version 3.44.12 and certain versions of 4.0.0 to 4.2.3, the server renders data without sufficient HTML escaping. This flaw allows attackers to exploit the feature.properties values from writable vector layers to execute arbitrary scripts or markup. Consequently, when a user interacts with an HTML page generated by QGIS Server, the attacker's code can execute within the session context, potentially leading to unauthorized access to viewer session data or the ability to perform authenticated actions on behalf of the victim.

Affected Version(s)

QGIS < 3.44.12 < 3.44.12

QGIS >= 4.0.0, <= 4.2.3 <= 4.0.0, 4.2.3

References

https://github.com/qgis/QGIS/security/advisories/GHSA-cr4...
x_refsource_CONFIRM
https://github.com/qgis/QGIS/pull/66616
x_refsource_MISC
https://github.com/qgis/QGIS/pull/67044
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.