{"id":"UBUNTU-CVE-2026-104140","details":"QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.","modified":"2026-10-17T12:58:42.910275052Z","published":"2026-10-12T22:17:00Z","upstream":["CVE-2026-104140"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-104140"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-104140"},{"type":"REPORT","url":"https://github.com/qgis/QGIS/commit/1930e81c918818a4f5412219f8f7e470d2709f91"},{"type":"REPORT","url":"https://github.com/qgis/QGIS/commit/ca76fcac616dbf1c0446514fd6517296eb7c6904"},{"type":"REPORT","url":"https://github.com/qgis/QGIS/pull/66616"},{"type":"REPORT","url":"https://github.com/qgis/QGIS/pull/67044"},{"type":"REPORT","url":"https://github.com/qgis/QGIS/releases/tag/final-3_44_12"},{"type":"REPORT","url":"https://github.com/qgis/QGIS/security/advisories/GHSA-cr49-pm9v-m788"}],"affected":[{"package":{"name":"qgis","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/qgis?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.3+dfsg-1","2.8.3+dfsg-5","2.8.4+dfsg-1","2.8.6+dfsg-1~exp2","2.8.6+dfsg-1","2.8.6+dfsg-1build1","2.8.6+dfsg-1ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"libqgis-analysis2.8.6","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_version":"2.8.6+dfsg-1ubuntu1","binary_name":"libqgis-core2.8.6"},{"binary_version":"2.8.6+dfsg-1ubuntu1","binary_name":"libqgis-customwidgets"},{"binary_name":"libqgis-gui2.8.6","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_name":"libqgis-networkanalysis2.8.6","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_version":"2.8.6+dfsg-1ubuntu1","binary_name":"libqgis-server2.8.6"},{"binary_name":"libqgisgrass2.8.6","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_name":"libqgispython2.8.6","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_name":"python-qgis","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_name":"python-qgis-common","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_version":"2.8.6+dfsg-1ubuntu1","binary_name":"qgis"},{"binary_name":"qgis-common","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_name":"qgis-plugin-globe","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_name":"qgis-plugin-globe-common","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_version":"2.8.6+dfsg-1ubuntu1","binary_name":"qgis-provider-grass"},{"binary_version":"2.8.6+dfsg-1ubuntu1","binary_name":"qgis-providers"},{"binary_name":"qgis-providers-common","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_name":"qgis-server","binary_version":"2.8.6+dfsg-1ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104140.json"}},{"package":{"name":"qgis","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/qgis?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.18+dfsg-1","2.14.20+dfsg-1build2","2.14.21+dfsg-1","2.14.21+dfsg-1build1","2.14.22+dfsg-2","2.18.17+dfsg-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libqgis-analysis2.18.17","binary_version":"2.18.17+dfsg-1"},{"binary_name":"libqgis-app2.18.17","binary_version":"2.18.17+dfsg-1"},{"binary_name":"libqgis-core2.18.17","binary_version":"2.18.17+dfsg-1"},{"binary_name":"libqgis-customwidgets","binary_version":"2.18.17+dfsg-1"},{"binary_name":"libqgis-gui2.18.17","binary_version":"2.18.17+dfsg-1"},{"binary_version":"2.18.17+dfsg-1","binary_name":"libqgis-networkanalysis2.18.17"},{"binary_name":"libqgis-server2.18.17","binary_version":"2.18.17+dfsg-1"},{"binary_name":"libqgisgrass7-2.18.17","binary_version":"2.18.17+dfsg-1"},{"binary_name":"libqgispython2.18.17","binary_version":"2.18.17+dfsg-1"},{"binary_name":"python-qgis","binary_version":"2.18.17+dfsg-1"},{"binary_name":"python-qgis-common","binary_version":"2.18.17+dfsg-1"},{"binary_name":"qgis","binary_version":"2.18.17+dfsg-1"},{"binary_name":"qgis-common","binary_version":"2.18.17+dfsg-1"},{"binary_name":"qgis-plugin-grass","binary_version":"2.18.17+dfsg-1"},{"binary_name":"qgis-plugin-grass-common","binary_version":"2.18.17+dfsg-1"},{"binary_version":"2.18.17+dfsg-1","binary_name":"qgis-provider-grass"},{"binary_name":"qgis-providers","binary_version":"2.18.17+dfsg-1"},{"binary_name":"qgis-providers-common","binary_version":"2.18.17+dfsg-1"},{"binary_name":"qgis-server","binary_version":"2.18.17+dfsg-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104140.json"}},{"package":{"name":"qgis","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/qgis?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.10+dfsg-1build1","3.4.10+dfsg-1build2","3.4.14+dfsg-1","3.4.15+dfsg-1ubuntu2","3.10.3+dfsg-1ubuntu1","3.10.4+dfsg-1ubuntu2"],"ecosystem_specific":{"binaries":[{"binary_version":"3.10.4+dfsg-1ubuntu2","binary_name":"libqgis-3d3.10.4"},{"binary_name":"libqgis-analysis3.10.4","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"libqgis-app3.10.4","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"libqgis-core3.10.4","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"libqgis-customwidgets","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"libqgis-gui3.10.4","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"libqgis-native3.10.4","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"libqgis-server3.10.4","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_version":"3.10.4+dfsg-1ubuntu2","binary_name":"libqgisgrass7-3.10.4"},{"binary_version":"3.10.4+dfsg-1ubuntu2","binary_name":"libqgispython3.10.4"},{"binary_name":"python3-qgis","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"python3-qgis-common","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"qgis","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_version":"3.10.4+dfsg-1ubuntu2","binary_name":"qgis-common"},{"binary_version":"3.10.4+dfsg-1ubuntu2","binary_name":"qgis-plugin-grass"},{"binary_name":"qgis-plugin-grass-common","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_version":"3.10.4+dfsg-1ubuntu2","binary_name":"qgis-provider-grass"},{"binary_name":"qgis-providers","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_version":"3.10.4+dfsg-1ubuntu2","binary_name":"qgis-providers-common"},{"binary_version":"3.10.4+dfsg-1ubuntu2","binary_name":"qgis-server"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104140.json"}},{"package":{"name":"qgis","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/qgis?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.14+dfsg-1ubuntu2","3.16.14+dfsg-1build1","3.16.15+dfsg-1","3.22.4+dfsg-3","3.22.4+dfsg-3build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libqgis-3d3.22.4","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"libqgis-analysis3.22.4","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"libqgis-app3.22.4","binary_version":"3.22.4+dfsg-3build1"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"libqgis-core3.22.4"},{"binary_name":"libqgis-customwidgets","binary_version":"3.22.4+dfsg-3build1"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"libqgis-gui3.22.4"},{"binary_name":"libqgis-native3.22.4","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"libqgis-server3.22.4","binary_version":"3.22.4+dfsg-3build1"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"libqgisgrass7-3.22.4"},{"binary_name":"libqgispython3.22.4","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"python3-qgis","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"python3-qgis-common","binary_version":"3.22.4+dfsg-3build1"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"qgis"},{"binary_name":"qgis-common","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"qgis-plugin-grass","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"qgis-plugin-grass-common","binary_version":"3.22.4+dfsg-3build1"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"qgis-provider-grass"},{"binary_name":"qgis-providers","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"qgis-providers-common","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"qgis-server","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"qgis-server-bin","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"qgis-server-common","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"qgis-server-dummy","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"qgis-server-landingpage","binary_version":"3.22.4+dfsg-3build1"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"qgis-server-wcs"},{"binary_name":"qgis-server-wfs","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"qgis-server-wfs3","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"qgis-server-wms","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"qgis-server-wmts","binary_version":"3.22.4+dfsg-3build1"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"qgis-sip"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104140.json"}},{"package":{"name":"qgis","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/qgis?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.28.10+dfsg-1","3.28.12+dfsg-1build1","3.28.13+dfsg-1","3.28.14+dfsg-1","3.28.15+dfsg-1","3.34.4+dfsg-1","3.34.4+dfsg-4","3.34.4+dfsg-4build1","3.34.4+dfsg-4build2"],"ecosystem_specific":{"binaries":[{"binary_name":"libqgis-3d3.34.4t64","binary_version":"3.34.4+dfsg-4build2"},{"binary_version":"3.34.4+dfsg-4build2","binary_name":"libqgis-analysis3.34.4t64"},{"binary_name":"libqgis-app3.34.4t64","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"libqgis-core3.34.4t64","binary_version":"3.34.4+dfsg-4build2"},{"binary_version":"3.34.4+dfsg-4build2","binary_name":"libqgis-customwidgets"},{"binary_name":"libqgis-gui3.34.4t64","binary_version":"3.34.4+dfsg-4build2"},{"binary_version":"3.34.4+dfsg-4build2","binary_name":"libqgis-native3.34.4t64"},{"binary_name":"libqgis-server3.34.4t64","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"libqgisgrass8-3.34.4t64","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"libqgispython3.34.4t64","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"python3-qgis","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"python3-qgis-common","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-common","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-plugin-grass","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-plugin-grass-common","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-provider-grass","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-providers","binary_version":"3.34.4+dfsg-4build2"},{"binary_version":"3.34.4+dfsg-4build2","binary_name":"qgis-providers-common"},{"binary_version":"3.34.4+dfsg-4build2","binary_name":"qgis-server"},{"binary_name":"qgis-server-bin","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-server-common","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-server-dummy","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-server-landingpage","binary_version":"3.34.4+dfsg-4build2"},{"binary_version":"3.34.4+dfsg-4build2","binary_name":"qgis-server-wcs"},{"binary_name":"qgis-server-wfs","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-server-wfs3","binary_version":"3.34.4+dfsg-4build2"},{"binary_version":"3.34.4+dfsg-4build2","binary_name":"qgis-server-wms"},{"binary_name":"qgis-server-wmts","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-sip","binary_version":"3.34.4+dfsg-4build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104140.json"}},{"package":{"name":"qgis","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/qgis?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.40.15+dfsg-1","3.44.11+dfsg-1build1","3.44.12+dfsg-1","3.44.13+dfsg-1","3.44.13+dfsg-3","3.44.13+dfsg-3build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libqgis-3d3.44.13","binary_version":"3.44.13+dfsg-3build1"},{"binary_name":"libqgis-analysis3.44.13","binary_version":"3.44.13+dfsg-3build1"},{"binary_version":"3.44.13+dfsg-3build1","binary_name":"libqgis-app3.44.13"},{"binary_name":"libqgis-core3.44.13","binary_version":"3.44.13+dfsg-3build1"},{"binary_version":"3.44.13+dfsg-3build1","binary_name":"libqgis-customwidgets"},{"binary_name":"libqgis-gui3.44.13","binary_version":"3.44.13+dfsg-3build1"},{"binary_version":"3.44.13+dfsg-3build1","binary_name":"libqgis-native3.44.13"},{"binary_name":"libqgis-server3.44.13","binary_version":"3.44.13+dfsg-3build1"},{"binary_version":"3.44.13+dfsg-3build1","binary_name":"libqgisgrass8-3.44.13"},{"binary_version":"3.44.13+dfsg-3build1","binary_name":"libqgispython3.44.13"},{"binary_version":"3.44.13+dfsg-3build1","binary_name":"python3-qgis"},{"binary_version":"3.44.13+dfsg-3build1","binary_name":"python3-qgis-common"},{"binary_name":"qgis","binary_version":"3.44.13+dfsg-3build1"},{"binary_name":"qgis-common","binary_version":"3.44.13+dfsg-3build1"},{"binary_name":"qgis-plugin-grass","binary_version":"3.44.13+dfsg-3build1"},{"binary_name":"qgis-plugin-grass-common","binary_version":"3.44.13+dfsg-3build1"},{"binary_name":"qgis-provider-grass","binary_version":"3.44.13+dfsg-3build1"},{"binary_name":"qgis-providers","binary_version":"3.44.13+dfsg-3build1"},{"binary_name":"qgis-providers-common","binary_version":"3.44.13+dfsg-3build1"},{"binary_version":"3.44.13+dfsg-3build1","binary_name":"qgis-server"},{"binary_version":"3.44.13+dfsg-3build1","binary_name":"qgis-server-bin"},{"binary_version":"3.44.13+dfsg-3build1","binary_name":"qgis-server-common"},{"binary_version":"3.44.13+dfsg-3build1","binary_name":"qgis-server-landingpage"},{"binary_version":"3.44.13+dfsg-3build1","binary_name":"qgis-server-wcs"},{"binary_version":"3.44.13+dfsg-3build1","binary_name":"qgis-server-wfs"},{"binary_version":"3.44.13+dfsg-3build1","binary_name":"qgis-server-wfs3"},{"binary_name":"qgis-server-wms","binary_version":"3.44.13+dfsg-3build1"},{"binary_name":"qgis-server-wmts","binary_version":"3.44.13+dfsg-3build1"},{"binary_name":"qgis-sip","binary_version":"3.44.13+dfsg-3build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104140.json"}},{"package":{"name":"qgis","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/qgis?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.40.8+dfsg-1~exp1","3.40.12+dfsg-1build1","3.40.12+dfsg-1build2","3.40.13+dfsg-2build1","3.40.14+dfsg-1","3.40.14+dfsg-1build1","3.40.15+dfsg-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libqgis-3d3.40.15","binary_version":"3.40.15+dfsg-1"},{"binary_version":"3.40.15+dfsg-1","binary_name":"libqgis-analysis3.40.15"},{"binary_name":"libqgis-app3.40.15","binary_version":"3.40.15+dfsg-1"},{"binary_name":"libqgis-core3.40.15","binary_version":"3.40.15+dfsg-1"},{"binary_name":"libqgis-customwidgets","binary_version":"3.40.15+dfsg-1"},{"binary_version":"3.40.15+dfsg-1","binary_name":"libqgis-gui3.40.15"},{"binary_name":"libqgis-native3.40.15","binary_version":"3.40.15+dfsg-1"},{"binary_name":"libqgis-server3.40.15","binary_version":"3.40.15+dfsg-1"},{"binary_version":"3.40.15+dfsg-1","binary_name":"libqgisgrass8-3.40.15"},{"binary_version":"3.40.15+dfsg-1","binary_name":"libqgispython3.40.15"},{"binary_name":"python3-qgis","binary_version":"3.40.15+dfsg-1"},{"binary_name":"python3-qgis-common","binary_version":"3.40.15+dfsg-1"},{"binary_version":"3.40.15+dfsg-1","binary_name":"qgis"},{"binary_name":"qgis-common","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis-plugin-grass","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis-plugin-grass-common","binary_version":"3.40.15+dfsg-1"},{"binary_version":"3.40.15+dfsg-1","binary_name":"qgis-provider-grass"},{"binary_version":"3.40.15+dfsg-1","binary_name":"qgis-providers"},{"binary_name":"qgis-providers-common","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis-server","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis-server-bin","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis-server-common","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis-server-landingpage","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis-server-wcs","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis-server-wfs","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis-server-wfs3","binary_version":"3.40.15+dfsg-1"},{"binary_version":"3.40.15+dfsg-1","binary_name":"qgis-server-wms"},{"binary_version":"3.40.15+dfsg-1","binary_name":"qgis-server-wmts"},{"binary_name":"qgis-sip","binary_version":"3.40.15+dfsg-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104140.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]}