CVE-2026-104140

QGIS Server is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in the WFS3 (OGC API Features) HTML responses. The root cause is the lack of HTML escaping for feature attribute values processed via QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. An attacker can inject...