CVE-2026-42881

STIGQter: Arbitrary File Write leading to Local Code Execution via Export HTML

CVSS 8.4 HIGHEPSS 0.2%CWE-22 CWE-73

Vexday Risk Score

41Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 8.4EPSS 0.2%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

14 May 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

STIGQter is an open-source reimplementation of DISA's STIG Viewer. From 0.1.2 to before 1.2.7, an attacker can achieve local code execution (LCE) with the privileges of the user running STIGQter. This requires user interaction: the victim must open the malicious .stigqter file and explicitly run the "Export HTML" action. This vulnerability is fixed in 1.2.7.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

squinky86 · STIGQter

public PoCs found — 1

cve_referencewww.bitwizemusic.com/security/advisories/bve-2026-0007/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/squinky86/STIGQter/security/advisories/GHSA-mcv5-5j7p-vqh7 https://www.bitwizemusic.com/security/advisories/bve-2026-0007 https://www.bitwizemusic.com/security/advisories/bve-2026-0007/