Executive brief
FACTION, a penetration testing report generation and collaboration framework, is vulnerable to a security flaw that allows attackers to inject malicious scripts into the platform. By uploading a file with a specially crafted name, an attacker can execute code in the browser of any user—including administrators—who views the file's preview. This could lead to full administrative takeover of the platform, unauthorized access to sensitive security reports, and the creation of new privileged accounts.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in FACTION prior to version 1.8.3. The root cause is the improper neutralization of user-supplied filenames within the remediation verification file preview flow. Specifically, filenames are persisted and subsequently rendered into HTML and JSON attribute contexts without adequate output encoding in components such as 'fileUpload.java' and 'RemVulnData.java'. An attacker with remediation privileges can upload a file with a malicious payload in the filename; when a manager or administrator views the verification/remediation views, the payload executes in their browser. This can be leveraged for session riding to perform administrative actions like creating new privileged users or modifying platform configurations. The issue is fixed in version 1.8.3 by implementing HTML/JSON escaping and server-side filename whitelisting.
Affected products
- factionsecurity FACTION < 1.8.3
Timeline
- 2026-05-05: patched: Version 1.8.3 released with security fixes.
- 2026-05-26: disclosed: CVE-2026-44667 published.