CVE-2026-42881CWE-22CWE-73

STIGQter: Arbitrary File Write leading to Local Code Execution via Export HTML

High · published May 14, 2026

CVSS v4.0
8.4
EPSS
0%
Percentile
8.3
In the wild
Unconfirmed
What it is

STIGQter is an open-source reimplementation of DISA's STIG Viewer. From 0.1.2 to before 1.2.7, an attacker can achieve local code execution (LCE) with the privileges of the user running STIGQter. This requires user interaction: the victim must open the malicious .stigqter file and explicitly run the "Export HTML" action. This vulnerability is fixed in 1.2.7.

The record
Technical detail
CVSS v4.0
8.4 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00191 · 8.3th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-73 · External Control of File Name or Path
Published
2026-05-14T15:05Z
EPSS history
Timeline
  • 14 MAY 15:05Z
    STIGQter: Arbitrary File Write leading to Local Code Execution via Export HTML
    cvelistv5