CVE-2026-104140: QGIS Server WFS3 XSS Vulnerability

CVE-2026-104140 Overview

CVE-2026-104140 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in QGIS Server. The flaw affects QGIS versions prior to 3.44.12 and versions 4.0.0 through 4.2.3. QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach the getFeatures.html template through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A viewer who opens an items HTML page executes attacker-supplied markup or script in the QGIS Server origin.

Critical Impact

Stored script execution in the QGIS Server origin can expose a viewer's session data or issue authenticated requests with the viewer's privileges.

Affected Products

• QGIS Server versions prior to 3.44.12
• QGIS Server versions 4.0.0 through 4.2.3
• Deployments exposing writable WFS3 (OGC API Features) vector layers

Discovery Timeline

• 2026-10-12 - CVE-2026-104140 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-104140

Vulnerability Analysis

The vulnerability resides in the QGIS Server WFS3 HTML renderer. When a client requests an items HTML page, the server iterates over feature.properties and emits each value directly into the HTML document. The template located at resources/server/api/ogc/templates/wfs3/getFeatures.html passes values through the if_nullptr_null_str callback but does not apply HTML escaping before output.

An attacker who can write features to a published vector layer stores a payload inside a property value. When another authenticated user opens the generated items HTML page, the browser parses the attacker payload as markup in the QGIS Server origin. The attacker inherits the viewer's session context, enabling theft of session identifiers or forged authenticated requests against the server API.

Root Cause

The root cause is missing output encoding in the inja template used by QgsServerOgcApiHandler::htmlDump. User-controlled feature attributes are injected into HTML without being passed through the escape() filter, producing a stored XSS primitive.

Attack Vector

The attack requires network access to a QGIS Server instance that exposes a writable WFS3 vector layer. The attacker inserts markup into a feature attribute through a legitimate write operation. Exploitation then requires a victim with higher privileges to open the items HTML endpoint containing the poisoned feature.

# Patch: resources/server/api/ogc/templates/wfs3/getFeatures.html
                <dl class="row">
                {% for name, value in feature.properties %}
                    <dt class="col-sm-12">{{ name }}</dt>
-                   <dd class="col-sm-12">{{ if_nullptr_null_str(value) }}</dd>
+                   <dd class="col-sm-12">{{ escape(if_nullptr_null_str(value)) }}</dd>
                {% endfor %}
                </dl>
            {% endfor %}

Source: QGIS Commit 1930e81

Detection Methods for CVE-2026-104140

Indicators of Compromise

• Feature attribute values in published vector layers containing HTML tags such as <script>, <img onerror=, or <svg onload=.
• Unexpected outbound requests from analyst browsers to attacker-controlled domains immediately after loading WFS3 items pages.
• Authenticated API calls to QGIS Server from user sessions that do not match normal interactive activity.

Detection Strategies

• Inspect WFS3 feature stores for persisted values containing angle brackets, JavaScript URI schemes, or event-handler attributes.
• Review HTTP access logs on QGIS Server for GET requests to /wfs3/collections/*/items followed by anomalous session behavior.
• Monitor browser Content Security Policy (CSP) violation reports from clients that consume QGIS Server HTML output.

Monitoring Recommendations

• Alert on write operations to WFS3 collections from untrusted or unauthenticated principals.
• Baseline the character set used in published feature attributes and flag entries that deviate significantly.
• Correlate authentication events with WFS3 HTML page loads to identify session-reuse anomalies.

How to Mitigate CVE-2026-104140

Immediate Actions Required

• Upgrade QGIS Server to version 3.44.12 or later. Version 4.2.3 and earlier in the 4.x branch remain affected per the advisory.
• Audit all WFS3 collections for stored HTML or script payloads in feature attribute values and sanitize or remove them.
• Restrict write access on published vector layers to trusted authenticated users only.

Patch Information

The fix adds the inja escape() function around attribute values in both getFeature.html and getFeatures.html templates. Review the GitHub Security Advisory GHSA-cr49-pm9v-m788 and the QGIS Release Final 3.44.12 notes. The backport is tracked in QGIS Commit ca76fca and discussed in QGIS Pull Request 67044.

Workarounds

• Disable the WFS3 (OGC API Features) HTML output format where feasible and serve only JSON responses.
• Place QGIS Server behind a reverse proxy that enforces a strict Content Security Policy blocking inline scripts.
• Revoke write permissions on any WFS layer that does not strictly require them until the patched version is deployed.

# Verify installed QGIS Server version
qgis_mapserv.fcgi --version 2>&1 | grep -i qgis

# Example nginx CSP header to limit inline script execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;