---
cve: "CVE-2026-42881"
severity: "HIGH"
cvss: 8.4
epss: "0.2%"
vendor: "squinky86"
kev: false
exploited: false
published: "2026-05-14 15:05:21"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T14:24:03+01:00"
---

# CVE-2026-42881

> 8.4 HIGH · 🧪 PoC

## Beschreibung

STIGQter is an open-source reimplementation of DISA's STIG Viewer. From 0.1.2 to before 1.2.7, an attacker can achieve local code execution (LCE) with the privileges of the user running STIGQter. This requires user interaction: the victim must open the malicious .stigqter file and explicitly run the "Export HTML" action. This vulnerability is fixed in 1.2.7.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-05-14 18:01:38
- CNA-CVSS: **8.4** (`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |

## Schwachstellen-Klasse

- **CWE-22** — Improper Limitation of a Pathname to a Restricted Directory
  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- **CWE-73** — External Control of File Name or Path
  The product allows user input to control or influence paths or file names that are used in filesystem operations.

## Angriffsmuster (CAPEC)

- [CAPEC-64 — Using Slashes and URL Encoding Combined to Bypass Validation Logic](https://capec.mitre.org/data/definitions/64.html) _(Severity: High)_
- [CAPEC-76 — Manipulating Web Input to File System Calls](https://capec.mitre.org/data/definitions/76.html) _(Severity: Very High)_
- [CAPEC-78 — Using Escaped Slashes in Alternate Encoding](https://capec.mitre.org/data/definitions/78.html) _(Severity: High)_
- [CAPEC-79 — Using Slashes in Alternate Encoding](https://capec.mitre.org/data/definitions/79.html) _(Severity: High)_
- [CAPEC-126 — Path Traversal](https://capec.mitre.org/data/definitions/126.html) _(Severity: Very High)_

## Patch verfügbar (OSV)

- 0765aed0ec37da883fb007b7be50778b352d1700 (Commit)

## Referenzen

- <https://github.com/squinky86/STIGQter/security/advisories/GHSA-mcv5-5j7p-vqh7>
- <https://www.bitwizemusic.com/security/advisories/bve-2026-0007>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-42881/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_