STIGQter: Arbitrary File Write leading to Local Code Execution via Export HTML
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.4epss 0.2%
exploitation probability
0.2%top 95% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
STIGQter is an open-source reimplementation of DISA's STIG Viewer. From 0.1.2 to before 1.2.7, an attacker can achieve local code execution (LCE) with the privileges of the user running STIGQter. This requires user interaction: the victim must open the malicious .stigqter file and explicitly run the "Export HTML" action. This vulnerability is fixed in 1.2.7.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
squinky86 · STIGQterpublic PoCs found — 1
cve_referencewww.bitwizemusic.com/security/advisories/bve-2026-0007/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.