Homepage

Cross-site Scripting (XSS) Affecting qgis package, versions <3.44.12+dfsg-1

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.24% (16th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN14-QGIS-20888223
  • published14 Oct 2026
  • disclosed12 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 12 Oct 2026

NewCVE-2026-104140  (opens in a new tab)
CWE-79  (opens in a new tab)

How to fix?

Upgrade Debian:14 qgis to version 3.44.12+dfsg-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream qgis package and not the qgis package as distributed by Debian. See How to fix? for Debian:14 relevant fixed versions and status.

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.