{"id":"UBUNTU-CVE-2026-24480","details":"QGIS is a free, open source, cross platform geographical information system (GIS) The repository contains a GitHub Actions workflow called \"pre-commit checks\" that, before commit 76a693cd91650f9b4e83edac525e5e4f90d954e9, was vulnerable to remote code execution and repository compromise because it used the `pull_request_target` trigger and then checked out and executed untrusted pull request code in a privileged context. Workflows triggered by `pull_request_target` ran with the base repository's credentials and access to secrets. If these workflows then checked out and executed code from the head of an external pull request (which could have been attacker controlled), the attacker could have executed arbitrary commands with elevated privileges. This insecure pattern has been documented as a security risk by GitHub and security researchers. Commit 76a693cd91650f9b4e83edac525e5e4f90d954e9 removed the vulnerable code.","modified":"2026-05-20T16:24:49.732191670Z","published":"2026-01-27T01:16:00Z","upstream":["CVE-2026-24480"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-24480"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-24480"},{"type":"REPORT","url":"https://github.com/qgis/QGIS/commit/76a693cd91650f9b4e83edac525e5e4f90d954e9"},{"type":"REPORT","url":"https://github.com/qgis/QGIS/security/advisories/GHSA-7h99-4f97-h6rw"}],"affected":[{"package":{"name":"qgis","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/qgis?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.3+dfsg-1","2.8.3+dfsg-5","2.8.4+dfsg-1","2.8.6+dfsg-1~exp2","2.8.6+dfsg-1","2.8.6+dfsg-1build1","2.8.6+dfsg-1ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"libqgis-analysis2.8.6","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_version":"2.8.6+dfsg-1ubuntu1","binary_name":"libqgis-core2.8.6"},{"binary_name":"libqgis-customwidgets","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_version":"2.8.6+dfsg-1ubuntu1","binary_name":"libqgis-gui2.8.6"},{"binary_version":"2.8.6+dfsg-1ubuntu1","binary_name":"libqgis-networkanalysis2.8.6"},{"binary_name":"libqgis-server2.8.6","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_version":"2.8.6+dfsg-1ubuntu1","binary_name":"libqgisgrass2.8.6"},{"binary_version":"2.8.6+dfsg-1ubuntu1","binary_name":"libqgispython2.8.6"},{"binary_version":"2.8.6+dfsg-1ubuntu1","binary_name":"python-qgis"},{"binary_version":"2.8.6+dfsg-1ubuntu1","binary_name":"python-qgis-common"},{"binary_name":"qgis","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_name":"qgis-common","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_name":"qgis-plugin-globe","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_version":"2.8.6+dfsg-1ubuntu1","binary_name":"qgis-plugin-globe-common"},{"binary_name":"qgis-provider-grass","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_name":"qgis-providers","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_name":"qgis-providers-common","binary_version":"2.8.6+dfsg-1ubuntu1"},{"binary_name":"qgis-server","binary_version":"2.8.6+dfsg-1ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-24480.json"}},{"package":{"name":"qgis","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/qgis?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.18+dfsg-1","2.14.20+dfsg-1build2","2.14.21+dfsg-1","2.14.21+dfsg-1build1","2.14.22+dfsg-2","2.18.17+dfsg-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libqgis-analysis2.18.17","binary_version":"2.18.17+dfsg-1"},{"binary_name":"libqgis-app2.18.17","binary_version":"2.18.17+dfsg-1"},{"binary_name":"libqgis-core2.18.17","binary_version":"2.18.17+dfsg-1"},{"binary_version":"2.18.17+dfsg-1","binary_name":"libqgis-customwidgets"},{"binary_name":"libqgis-gui2.18.17","binary_version":"2.18.17+dfsg-1"},{"binary_name":"libqgis-networkanalysis2.18.17","binary_version":"2.18.17+dfsg-1"},{"binary_name":"libqgis-server2.18.17","binary_version":"2.18.17+dfsg-1"},{"binary_name":"libqgisgrass7-2.18.17","binary_version":"2.18.17+dfsg-1"},{"binary_version":"2.18.17+dfsg-1","binary_name":"libqgispython2.18.17"},{"binary_name":"python-qgis","binary_version":"2.18.17+dfsg-1"},{"binary_name":"python-qgis-common","binary_version":"2.18.17+dfsg-1"},{"binary_version":"2.18.17+dfsg-1","binary_name":"qgis"},{"binary_version":"2.18.17+dfsg-1","binary_name":"qgis-common"},{"binary_version":"2.18.17+dfsg-1","binary_name":"qgis-plugin-grass"},{"binary_name":"qgis-plugin-grass-common","binary_version":"2.18.17+dfsg-1"},{"binary_version":"2.18.17+dfsg-1","binary_name":"qgis-provider-grass"},{"binary_name":"qgis-providers","binary_version":"2.18.17+dfsg-1"},{"binary_version":"2.18.17+dfsg-1","binary_name":"qgis-providers-common"},{"binary_name":"qgis-server","binary_version":"2.18.17+dfsg-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-24480.json"}},{"package":{"name":"qgis","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/qgis?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.10+dfsg-1build1","3.4.10+dfsg-1build2","3.4.14+dfsg-1","3.4.15+dfsg-1ubuntu2","3.10.3+dfsg-1ubuntu1","3.10.4+dfsg-1ubuntu2"],"ecosystem_specific":{"binaries":[{"binary_name":"libqgis-3d3.10.4","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"libqgis-analysis3.10.4","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_version":"3.10.4+dfsg-1ubuntu2","binary_name":"libqgis-app3.10.4"},{"binary_name":"libqgis-core3.10.4","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"libqgis-customwidgets","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"libqgis-gui3.10.4","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"libqgis-native3.10.4","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"libqgis-server3.10.4","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"libqgisgrass7-3.10.4","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_version":"3.10.4+dfsg-1ubuntu2","binary_name":"libqgispython3.10.4"},{"binary_name":"python3-qgis","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"python3-qgis-common","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"qgis","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"qgis-common","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_version":"3.10.4+dfsg-1ubuntu2","binary_name":"qgis-plugin-grass"},{"binary_name":"qgis-plugin-grass-common","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"qgis-provider-grass","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_name":"qgis-providers","binary_version":"3.10.4+dfsg-1ubuntu2"},{"binary_version":"3.10.4+dfsg-1ubuntu2","binary_name":"qgis-providers-common"},{"binary_version":"3.10.4+dfsg-1ubuntu2","binary_name":"qgis-server"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-24480.json"}},{"package":{"name":"qgis","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/qgis?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.14+dfsg-1ubuntu2","3.16.14+dfsg-1build1","3.16.15+dfsg-1","3.22.4+dfsg-3","3.22.4+dfsg-3build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libqgis-3d3.22.4","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"libqgis-analysis3.22.4","binary_version":"3.22.4+dfsg-3build1"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"libqgis-app3.22.4"},{"binary_name":"libqgis-core3.22.4","binary_version":"3.22.4+dfsg-3build1"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"libqgis-customwidgets"},{"binary_name":"libqgis-gui3.22.4","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"libqgis-native3.22.4","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"libqgis-server3.22.4","binary_version":"3.22.4+dfsg-3build1"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"libqgisgrass7-3.22.4"},{"binary_name":"libqgispython3.22.4","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"python3-qgis","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"python3-qgis-common","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"qgis","binary_version":"3.22.4+dfsg-3build1"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"qgis-common"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"qgis-plugin-grass"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"qgis-plugin-grass-common"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"qgis-provider-grass"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"qgis-providers"},{"binary_name":"qgis-providers-common","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"qgis-server","binary_version":"3.22.4+dfsg-3build1"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"qgis-server-bin"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"qgis-server-common"},{"binary_name":"qgis-server-dummy","binary_version":"3.22.4+dfsg-3build1"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"qgis-server-landingpage"},{"binary_name":"qgis-server-wcs","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"qgis-server-wfs","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"qgis-server-wfs3","binary_version":"3.22.4+dfsg-3build1"},{"binary_name":"qgis-server-wms","binary_version":"3.22.4+dfsg-3build1"},{"binary_version":"3.22.4+dfsg-3build1","binary_name":"qgis-server-wmts"},{"binary_name":"qgis-sip","binary_version":"3.22.4+dfsg-3build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-24480.json"}},{"package":{"name":"qgis","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/qgis?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.28.10+dfsg-1","3.28.12+dfsg-1build1","3.28.13+dfsg-1","3.28.14+dfsg-1","3.28.15+dfsg-1","3.34.4+dfsg-1","3.34.4+dfsg-4","3.34.4+dfsg-4build1","3.34.4+dfsg-4build2"],"ecosystem_specific":{"binaries":[{"binary_version":"3.34.4+dfsg-4build2","binary_name":"libqgis-3d3.34.4t64"},{"binary_name":"libqgis-analysis3.34.4t64","binary_version":"3.34.4+dfsg-4build2"},{"binary_version":"3.34.4+dfsg-4build2","binary_name":"libqgis-app3.34.4t64"},{"binary_name":"libqgis-core3.34.4t64","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"libqgis-customwidgets","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"libqgis-gui3.34.4t64","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"libqgis-native3.34.4t64","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"libqgis-server3.34.4t64","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"libqgisgrass8-3.34.4t64","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"libqgispython3.34.4t64","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"python3-qgis","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"python3-qgis-common","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-common","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-plugin-grass","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-plugin-grass-common","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-provider-grass","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-providers","binary_version":"3.34.4+dfsg-4build2"},{"binary_version":"3.34.4+dfsg-4build2","binary_name":"qgis-providers-common"},{"binary_version":"3.34.4+dfsg-4build2","binary_name":"qgis-server"},{"binary_name":"qgis-server-bin","binary_version":"3.34.4+dfsg-4build2"},{"binary_version":"3.34.4+dfsg-4build2","binary_name":"qgis-server-common"},{"binary_name":"qgis-server-dummy","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-server-landingpage","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-server-wcs","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-server-wfs","binary_version":"3.34.4+dfsg-4build2"},{"binary_version":"3.34.4+dfsg-4build2","binary_name":"qgis-server-wfs3"},{"binary_version":"3.34.4+dfsg-4build2","binary_name":"qgis-server-wms"},{"binary_name":"qgis-server-wmts","binary_version":"3.34.4+dfsg-4build2"},{"binary_name":"qgis-sip","binary_version":"3.34.4+dfsg-4build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-24480.json"}},{"package":{"name":"qgis","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/qgis?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.40.5+dfsg-1","3.40.6+dfsg-1","3.40.6+dfsg-1build1","3.40.8+dfsg-1~exp1"],"ecosystem_specific":{"binaries":[{"binary_name":"libqgis-3d3.40.8","binary_version":"3.40.8+dfsg-1~exp1"},{"binary_version":"3.40.8+dfsg-1~exp1","binary_name":"libqgis-analysis3.40.8"},{"binary_name":"libqgis-app3.40.8","binary_version":"3.40.8+dfsg-1~exp1"},{"binary_name":"libqgis-core3.40.8","binary_version":"3.40.8+dfsg-1~exp1"},{"binary_name":"libqgis-customwidgets","binary_version":"3.40.8+dfsg-1~exp1"},{"binary_version":"3.40.8+dfsg-1~exp1","binary_name":"libqgis-gui3.40.8"},{"binary_name":"libqgis-native3.40.8","binary_version":"3.40.8+dfsg-1~exp1"},{"binary_version":"3.40.8+dfsg-1~exp1","binary_name":"libqgis-server3.40.8"},{"binary_version":"3.40.8+dfsg-1~exp1","binary_name":"libqgisgrass8-3.40.8"},{"binary_name":"libqgispython3.40.8","binary_version":"3.40.8+dfsg-1~exp1"},{"binary_name":"python3-qgis","binary_version":"3.40.8+dfsg-1~exp1"},{"binary_name":"python3-qgis-common","binary_version":"3.40.8+dfsg-1~exp1"},{"binary_version":"3.40.8+dfsg-1~exp1","binary_name":"qgis"},{"binary_name":"qgis-common","binary_version":"3.40.8+dfsg-1~exp1"},{"binary_name":"qgis-plugin-grass","binary_version":"3.40.8+dfsg-1~exp1"},{"binary_name":"qgis-plugin-grass-common","binary_version":"3.40.8+dfsg-1~exp1"},{"binary_name":"qgis-provider-grass","binary_version":"3.40.8+dfsg-1~exp1"},{"binary_name":"qgis-providers","binary_version":"3.40.8+dfsg-1~exp1"},{"binary_version":"3.40.8+dfsg-1~exp1","binary_name":"qgis-providers-common"},{"binary_version":"3.40.8+dfsg-1~exp1","binary_name":"qgis-server"},{"binary_name":"qgis-server-bin","binary_version":"3.40.8+dfsg-1~exp1"},{"binary_name":"qgis-server-common","binary_version":"3.40.8+dfsg-1~exp1"},{"binary_name":"qgis-server-landingpage","binary_version":"3.40.8+dfsg-1~exp1"},{"binary_version":"3.40.8+dfsg-1~exp1","binary_name":"qgis-server-wcs"},{"binary_version":"3.40.8+dfsg-1~exp1","binary_name":"qgis-server-wfs"},{"binary_version":"3.40.8+dfsg-1~exp1","binary_name":"qgis-server-wfs3"},{"binary_version":"3.40.8+dfsg-1~exp1","binary_name":"qgis-server-wms"},{"binary_name":"qgis-server-wmts","binary_version":"3.40.8+dfsg-1~exp1"},{"binary_version":"3.40.8+dfsg-1~exp1","binary_name":"qgis-sip"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-24480.json"}},{"package":{"name":"qgis","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/qgis?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.40.8+dfsg-1~exp1","3.40.12+dfsg-1build1","3.40.12+dfsg-1build2","3.40.13+dfsg-2build1","3.40.14+dfsg-1","3.40.14+dfsg-1build1","3.40.15+dfsg-1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.40.15+dfsg-1","binary_name":"libqgis-3d3.40.15"},{"binary_name":"libqgis-analysis3.40.15","binary_version":"3.40.15+dfsg-1"},{"binary_name":"libqgis-app3.40.15","binary_version":"3.40.15+dfsg-1"},{"binary_name":"libqgis-core3.40.15","binary_version":"3.40.15+dfsg-1"},{"binary_name":"libqgis-customwidgets","binary_version":"3.40.15+dfsg-1"},{"binary_name":"libqgis-gui3.40.15","binary_version":"3.40.15+dfsg-1"},{"binary_name":"libqgis-native3.40.15","binary_version":"3.40.15+dfsg-1"},{"binary_name":"libqgis-server3.40.15","binary_version":"3.40.15+dfsg-1"},{"binary_version":"3.40.15+dfsg-1","binary_name":"libqgisgrass8-3.40.15"},{"binary_name":"libqgispython3.40.15","binary_version":"3.40.15+dfsg-1"},{"binary_name":"python3-qgis","binary_version":"3.40.15+dfsg-1"},{"binary_name":"python3-qgis-common","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis-common","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis-plugin-grass","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis-plugin-grass-common","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis-provider-grass","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis-providers","binary_version":"3.40.15+dfsg-1"},{"binary_version":"3.40.15+dfsg-1","binary_name":"qgis-providers-common"},{"binary_version":"3.40.15+dfsg-1","binary_name":"qgis-server"},{"binary_version":"3.40.15+dfsg-1","binary_name":"qgis-server-bin"},{"binary_name":"qgis-server-common","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis-server-landingpage","binary_version":"3.40.15+dfsg-1"},{"binary_version":"3.40.15+dfsg-1","binary_name":"qgis-server-wcs"},{"binary_version":"3.40.15+dfsg-1","binary_name":"qgis-server-wfs"},{"binary_name":"qgis-server-wfs3","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis-server-wms","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis-server-wmts","binary_version":"3.40.15+dfsg-1"},{"binary_name":"qgis-sip","binary_version":"3.40.15+dfsg-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-24480.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}