QGIS Server fails to escape feature attribute values when rendering the WFS3 (OGC API Features) getFeatures.html page. Feature properties that originate from a published, writable vector layer are injected directly into the HTML response. When a user opens that page in a browser, any embedded HTML or JavaScript executes in the context of the QGIS Server origin. An attacker can therefore inject malicious markup to exfiltrate the victim’s session cookies, read other data available to the user’s account, or perform authenticated requests on behalf of the viewer, potentially escalating privileges if the user is an administrator or holds privileged roles.

This flaw exists in QGIS Server versions that precede 3.44.12 as well as in the 4.0.0 through 4.2.3 releases. The affected product is the QGIS Server component of QGIS, which is used to expose geographic data via the WFS3 API. Upgrading to 3.44.12 or any later 4.x release removes the vulnerability.

The CVSS score of 6.1 indicates moderate overall risk. No EPSS value is provided, so the current exploit probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker be able to publish a writable vector layer containing malicious attribute values and that the victim load the WFS3 getFeatures page in a browser that accepts the request. While the attack vector relies on an available writable layer, the ability to execute arbitrary script from the server origin can lead to session hijacking or further credential‑based attacks if the victim has elevated permissions.