{"id":"DEBIAN-CVE-2026-104140","details":"QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.","modified":"2026-10-14T09:47:33.452056421Z","published":"2026-10-12T22:17:03.273Z","upstream":["CVE-2026-104140"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-104140"}],"affected":[{"package":{"name":"qgis","ecosystem":"Debian:12","purl":"pkg:deb/debian/qgis?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.22.16+dfsg-1","3.28.10+dfsg-1","3.28.10+dfsg-1~bpo12+1","3.28.10+dfsg-1~exp1","3.28.11+dfsg-1","3.28.11+dfsg-1~bpo12+1","3.28.11+dfsg-1~exp1","3.28.11+dfsg-2","3.28.12+dfsg-1","3.28.12+dfsg-1~bpo12+1","3.28.12+dfsg-1~exp1","3.28.13+dfsg-1","3.28.13+dfsg-1~bpo12+1","3.28.13+dfsg-1~exp1","3.28.14+dfsg-1","3.28.14+dfsg-1~bpo12+1","3.28.14+dfsg-1~exp1","3.28.15+dfsg-1","3.28.15+dfsg-1.1~exp1","3.28.15+dfsg-1~bpo12+1","3.28.15+dfsg-1~exp1","3.28.15+dfsg-2~exp1","3.28.4+dfsg-1~exp1","3.28.5+dfsg-1~exp1","3.28.6+dfsg-1~exp1","3.28.7+dfsg-1","3.28.7+dfsg-1~exp1","3.28.8+dfsg-1","3.28.8+dfsg-1~bpo12+1","3.28.8+dfsg-1~exp1","3.28.9+dfsg-1","3.28.9+dfsg-1~bpo11+1","3.28.9+dfsg-1~bpo12+1","3.28.9+dfsg-1~exp1","3.34.10+dfsg-1","3.34.10+dfsg-1~bpo12+1","3.34.10+dfsg-1~exp1","3.34.11+dfsg-1","3.34.11+dfsg-1~bpo12+1","3.34.11+dfsg-1~exp1","3.34.12+dfsg-1","3.34.12+dfsg-1~bpo12+1","3.34.12+dfsg-1~exp1","3.34.13+dfsg-1","3.34.13+dfsg-1~bpo12+1","3.34.13+dfsg-1~exp1","3.34.14+dfsg-1","3.34.14+dfsg-1~bpo12+1","3.34.14+dfsg-1~exp1","3.34.15+dfsg-1","3.34.15+dfsg-1~bpo12+1","3.34.15+dfsg-1~exp1","3.34.15+dfsg-2","3.34.4+dfsg-1","3.34.4+dfsg-1~exp1","3.34.4+dfsg-2","3.34.4+dfsg-2~exp1","3.34.4+dfsg-3","3.34.4+dfsg-4","3.34.5+dfsg-1","3.34.5+dfsg-1~exp1","3.34.6+dfsg-1","3.34.6+dfsg-1~bpo12+1","3.34.6+dfsg-1~exp1","3.34.7+dfsg-1","3.34.7+dfsg-1~bpo12+1","3.34.7+dfsg-1~exp1","3.34.8+dfsg-1","3.34.8+dfsg-1~bpo12+1","3.34.8+dfsg-1~exp1","3.34.9+dfsg-1","3.34.9+dfsg-1~exp1","3.34.9+dfsg-2","3.40.10+dfsg-1","3.40.10+dfsg-1~bpo13+1","3.40.10+dfsg-1~exp1","3.40.11+dfsg-1","3.40.11+dfsg-1~bpo13+1","3.40.12+dfsg-1","3.40.12+dfsg-1~bpo13+1","3.40.13+dfsg-1","3.40.13+dfsg-2","3.40.13+dfsg-2~bpo13+1","3.40.14+dfsg-1","3.40.14+dfsg-1~bpo13+1","3.40.15+dfsg-1","3.40.15+dfsg-1~bpo13+1","3.40.4+dfsg-1","3.40.4+dfsg-1~exp1","3.40.4+dfsg-2","3.40.4+dfsg-3","3.40.4+dfsg-3~bpo12+1","3.40.5+dfsg-1","3.40.5+dfsg-1~bpo12+1","3.40.5+dfsg-1~exp1","3.40.6+dfsg-1","3.40.6+dfsg-1~bpo12+1","3.40.6+dfsg-1~exp1","3.40.7+dfsg-1~exp1","3.40.8+dfsg-1~exp1","3.40.9+dfsg-1","3.40.9+dfsg-1~exp1","3.44.10+dfsg-1","3.44.10+dfsg-1~exp1","3.44.10+dfsg-2","3.44.10+dfsg-2~bpo13+1","3.44.11+dfsg-1","3.44.11+dfsg-1~bpo13+1","3.44.11+dfsg-1~exp1","3.44.12+dfsg-1","3.44.12+dfsg-1~bpo13+1","3.44.12+dfsg-1~exp1","3.44.13+dfsg-1","3.44.13+dfsg-1~bpo13+1","3.44.13+dfsg-1~exp1","3.44.13+dfsg-2","3.44.13+dfsg-3","3.44.14+dfsg-1","3.44.14+dfsg-1~bpo13+1","3.44.14+dfsg-1~exp1","3.44.15+dfsg-1","3.44.15+dfsg-1~bpo13+1","3.44.8+dfsg-1","3.44.8+dfsg-1~bpo13+1","3.44.8+dfsg-1~exp1","3.44.9+dfsg-1","3.44.9+dfsg-1~bpo13+1","3.44.9+dfsg-1~exp1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-104140.json"}},{"package":{"name":"qgis","ecosystem":"Debian:13","purl":"pkg:deb/debian/qgis?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.40.10+dfsg-1","3.40.10+dfsg-1~bpo13+1","3.40.10+dfsg-1~exp1","3.40.11+dfsg-1","3.40.11+dfsg-1~bpo13+1","3.40.12+dfsg-1","3.40.12+dfsg-1~bpo13+1","3.40.13+dfsg-1","3.40.13+dfsg-2","3.40.13+dfsg-2~bpo13+1","3.40.14+dfsg-1","3.40.14+dfsg-1~bpo13+1","3.40.15+dfsg-1","3.40.15+dfsg-1~bpo13+1","3.40.6+dfsg-1","3.40.7+dfsg-1~exp1","3.40.8+dfsg-1~exp1","3.40.9+dfsg-1","3.40.9+dfsg-1~exp1","3.44.10+dfsg-1","3.44.10+dfsg-1~exp1","3.44.10+dfsg-2","3.44.10+dfsg-2~bpo13+1","3.44.11+dfsg-1","3.44.11+dfsg-1~bpo13+1","3.44.11+dfsg-1~exp1","3.44.12+dfsg-1","3.44.12+dfsg-1~bpo13+1","3.44.12+dfsg-1~exp1","3.44.13+dfsg-1","3.44.13+dfsg-1~bpo13+1","3.44.13+dfsg-1~exp1","3.44.13+dfsg-2","3.44.13+dfsg-3","3.44.14+dfsg-1","3.44.14+dfsg-1~bpo13+1","3.44.14+dfsg-1~exp1","3.44.15+dfsg-1","3.44.15+dfsg-1~bpo13+1","3.44.8+dfsg-1","3.44.8+dfsg-1~bpo13+1","3.44.8+dfsg-1~exp1","3.44.9+dfsg-1","3.44.9+dfsg-1~bpo13+1","3.44.9+dfsg-1~exp1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-104140.json"}},{"package":{"name":"qgis","ecosystem":"Debian:14","purl":"pkg:deb/debian/qgis?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.44.12+dfsg-1"}]}],"versions":["3.40.10+dfsg-1","3.40.10+dfsg-1~bpo13+1","3.40.10+dfsg-1~exp1","3.40.11+dfsg-1","3.40.11+dfsg-1~bpo13+1","3.40.12+dfsg-1","3.40.12+dfsg-1~bpo13+1","3.40.13+dfsg-1","3.40.13+dfsg-2","3.40.13+dfsg-2~bpo13+1","3.40.14+dfsg-1","3.40.14+dfsg-1~bpo13+1","3.40.15+dfsg-1","3.40.15+dfsg-1~bpo13+1","3.40.6+dfsg-1","3.40.7+dfsg-1~exp1","3.40.8+dfsg-1~exp1","3.40.9+dfsg-1","3.40.9+dfsg-1~exp1","3.44.10+dfsg-1","3.44.10+dfsg-1~exp1","3.44.10+dfsg-2","3.44.10+dfsg-2~bpo13+1","3.44.11+dfsg-1","3.44.11+dfsg-1~bpo13+1","3.44.11+dfsg-1~exp1","3.44.12+dfsg-1~bpo13+1","3.44.12+dfsg-1~exp1","3.44.8+dfsg-1","3.44.8+dfsg-1~bpo13+1","3.44.8+dfsg-1~exp1","3.44.9+dfsg-1","3.44.9+dfsg-1~bpo13+1","3.44.9+dfsg-1~exp1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-104140.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}