CVE catalog

CVE-2026-104140

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without

[CVE catalog]

Severity: Medium · CVSS 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published: Oct 12, 2026, 9:53:29 PM UTC
Updated: Oct 12, 2026, 10:17:03 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.24% · Oct 25, 2026

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	qgis	sid	`3.44.15+dfsg-1`	fixed
Debian	qgis	forky	`3.44.15+dfsg-1`	fixed
Debian	qgis	trixie	`3.40.6+dfsg-1`	vulnerable
Debian	qgis	bookworm	`3.22.16+dfsg-1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	qgis	source	sid	`3.44.12+dfsg-1`	not yet assigned	Not reported	Not reported
Debian	qgis	source	forky	`3.44.12+dfsg-1`	not yet assigned	Not reported	Not reported
Debian	qgis	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	qgis	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libqgis-3d3.22.16]Affected
Source package: [qgis]
Details (2)
- 3.22.16+dfsg-1 · amd64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.22.16+dfsg-1 · arm64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgis-3d3.40.6]Affected
Source package: [qgis]
Details (2)
- 3.40.6+dfsg-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.40.6+dfsg-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgis-analysis3.22.16]Affected
Source package: [qgis]
Details (2)
- 3.22.16+dfsg-1 · amd64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.22.16+dfsg-1 · arm64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgis-analysis3.40.6]Affected
Source package: [qgis]
Details (2)
- 3.40.6+dfsg-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.40.6+dfsg-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgis-app3.22.16]Affected
Source package: [qgis]
Details (2)
- 3.22.16+dfsg-1 · amd64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.22.16+dfsg-1 · arm64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgis-app3.40.6]Affected
Source package: [qgis]
Details (2)
- 3.40.6+dfsg-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.40.6+dfsg-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgis-core3.22.16]Affected
Source package: [qgis]
Details (2)
- 3.22.16+dfsg-1 · amd64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.22.16+dfsg-1 · arm64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgis-core3.40.6]Affected
Source package: [qgis]
Details (2)
- 3.40.6+dfsg-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.40.6+dfsg-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgis-customwidgets]Affected
Source package: [qgis]
Details (4)
- 3.22.16+dfsg-1 · amd64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.22.16+dfsg-1 · arm64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.40.6+dfsg-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.40.6+dfsg-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgis-dev]Affected
Source package: [qgis]
Details (4)
- 3.22.16+dfsg-1 · amd64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.22.16+dfsg-1 · arm64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.40.6+dfsg-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.40.6+dfsg-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgisgrass8-3.22.16]Affected
Source package: [qgis]
Details (2)
- 3.22.16+dfsg-1 · amd64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.22.16+dfsg-1 · arm64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgisgrass8-3.40.6]Affected
Source package: [qgis]
Details (2)
- 3.40.6+dfsg-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.40.6+dfsg-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgis-gui3.22.16]Affected
Source package: [qgis]
Details (2)
- 3.22.16+dfsg-1 · amd64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.22.16+dfsg-1 · arm64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgis-gui3.40.6]Affected
Source package: [qgis]
Details (2)
- 3.40.6+dfsg-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.40.6+dfsg-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgis-native3.22.16]Affected
Source package: [qgis]
Details (2)
- 3.22.16+dfsg-1 · amd64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.22.16+dfsg-1 · arm64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgis-native3.40.6]Affected
Source package: [qgis]
Details (2)
- 3.40.6+dfsg-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.40.6+dfsg-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgispython3.22.16]Affected
Source package: [qgis]
Details (2)
- 3.22.16+dfsg-1 · amd64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.22.16+dfsg-1 · arm64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgispython3.40.6]Affected
Source package: [qgis]
Details (2)
- 3.40.6+dfsg-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.40.6+dfsg-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgis-server3.22.16]Affected
Source package: [qgis]
Details (2)
- 3.22.16+dfsg-1 · amd64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.22.16+dfsg-1 · arm64 · bookworm
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
[libqgis-server3.40.6]Affected
Source package: [qgis]
Details (2)
- 3.40.6+dfsg-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12
- 3.40.6+dfsg-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · qgis · debian · bookworm; nvd · qgis · debian · 12

Next results

Observed: Oct 24, 2026, 6:50:50 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]