Home

Description

STIGQter is an open-source reimplementation of DISA's STIG Viewer. From 0.1.2 to before 1.2.7, an attacker can achieve local code execution (LCE) with the privileges of the user running STIGQter. This requires user interaction: the victim must open the malicious .stigqter file and explicitly run the "Export HTML" action. This vulnerability is fixed in 1.2.7.

PUBLISHED Reserved 2026-04-30 | Published 2026-05-14 | Updated 2026-05-14 | Assigner GitHub_M




HIGH: 8.4CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-73: External Control of File Name or Path

Product status

>= 0.1.2, < 1.2.7
affected

References

www.bitwizemusic.com/security/advisories/bve-2026-0007/ exploit

github.com/...IGQter/security/advisories/GHSA-mcv5-5j7p-vqh7

www.bitwizemusic.com/security/advisories/bve-2026-0007

cve.org (CVE-2026-42881)

nvd.nist.gov (CVE-2026-42881)

Download JSON