CVE-2026-104140 | QGIS up to 3.44.11/4.2.3 OGC API Features Rendering getFeatures.html htmlDump feature.properties cross site scripting

October 12, 2026 Yanac

A vulnerability was found in QGIS up to 3.44.11/4.2.3. It has been rated as problematic. The affected element is the function QgsServerOgcApiHandler::htmlDump of the file resources/server/api/ogc/templates/wfs3/getFeatures.html of the component OGC API Features Rendering. Performing a manipulation of the argument feature.properties results in cross site scripting.

This vulnerability is identified as CVE-2026-104140. The attack can be initiated remotely. There is not any exploit available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More