The vulnerability in STIGQter allows an attacker to perform an arbitrary file write when a malicious .stigqter file is opened and the user explicitly selects the "Export HTML" action. This flaw leads to local code execution with the privileges of the user running the application and is associated with CWE-22 and CWE-73 weakness types. The exploitation may compromise system integrity and confidentiality if the attacker can write files to arbitrary locations or overwrite critical data.

The issue affects the squinky86:STIGQter open‑source reimplementation of DISA's STIG Viewer. Versions from 0.1.2 up to but not including 1.2.7 are vulnerable; all later releases contain a fix.

The CVSS score of 8.4 indicates a high severity risk. The EPSS score is not available, so the probability of exploitation cannot be quantified, but the vulnerability is well known and listed in public advisories. It is not flagged in the CISA KEV catalog. Exploitation requires local user interaction: the victim must open a malicious file and choose to run the Export HTML command, after which the attacker gains code execution with the running user's rights. The affected scope is limited to the local machine that runs STIGQter.