QGIS Server CVE-2026-104140

Exploitation requires (1) QGIS Server with the WFS3 / OGC API Features interface enabled and serving HTML responses, and (2) a published vector layer that is WRITABLE so the attacker can inject arbitrary values into feature.properties (e.g. via WFS-T transactions) - a flaw against the getFeatures.html/getFeature.html templates reached through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. Exploitation is further gated by required user interaction (UI:R): a victim must open the affected items or feature HTML page in a browser for the stored payload to execute. These limiting factors - the non-default writable-layer configuration and the need for a human to view the page - meaningfully constrain real-world risk below what the network attack vector alone implies; versions 3.44.12 and later (and 4.x once patched) are not affected.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in QGIS Server's WFS3 / OGC API Features HTML renderer, rated CVSS 6.1 (Medium) by the vendor with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The network vector and low complexity are real, but two signals temper the raw score: UI:R means a victim must actually open the items/getFeature HTML page, and the attacker must first get malicious markup into feature.properties of a PUBLISHED, WRITABLE vector layer - a non-default, deployment-specific precondition that the PR:N metric does not capture well. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no public exploit identified at time of analysis; exploitation is therefore theoretical rather than observed. The scope change (S:C) is justified because the injected script executes in the QGIS Server origin against the viewer rather than the attacker's own context, enabling session-data theft or authenticated requests as the viewer (C:L/I:L). Net assessment: a legitimate medium-severity web vulnerability worth patching on exposed QGIS Server instances, but not an urgent mass-exploitation priority - the writable-layer and user-interaction requirements make it better suited to targeted attacks against multi-user QGIS Server deployments than to opportunistic internet-wide exploitation.

In a QGIS Server deployment that publishes a vector layer writable via WFS-T, an attacker submits a feature whose text property contains markup such as <script>...</script> or an event-handler payload. When a legitimate analyst later browses that layer's items HTML page (e.g. /wfs3/collections/<layer>/items.html), the unescaped value executes in the QGIS Server origin, letting the attacker read the viewer's session data or issue requests with the viewer's privileges. No public exploit was provided, though the vendor's regression test demonstrates the unescaped-to-escaped behavior change.