# CVE-2026-44667: factionsecurity FACTION stored XSS in remediation file previews

Source: https://junglewise.ai/threats/cve-2026-44667-factionsecurity-faction-stored-xss-in-remediation-file-previews  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-44667 · Severity: high · CVSS 8.7 · Published 2026-05-26

FACTION, a penetration testing report generation and collaboration framework, is vulnerable to a security flaw that allows attackers to inject malicious scripts into the platform. By uploading a file with a specially crafted name, an attacker can execute code in the browser of any user—including administrators—who views the file's preview. This could lead to full administrative takeover of the platform, unauthorized access to sensitive security reports, and the creation of new privileged accounts.

Technologies: [Faction Security FACTION](https://junglewise.ai/threats/technologies/faction). Vendors: [Faction Security](https://junglewise.ai/threats/vendors/faction-security).

## Quick answers

**Is CVE-2026-44667 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44667 being exploited in the wild.

**How severe is CVE-2026-44667?** High severity, with a CVSS score of 8.7, published 26 May 2026.

**Which products and versions are affected?** Faction Security FACTION < 1.8.3.

**Is there a fix for CVE-2026-44667?** A patch was published on 2026-05-05: Version 1.8.3 released with security fixes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44667 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44667?** Check whether you run Faction Security FACTION at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in FACTION prior to version 1.8.3. The root cause is the improper neutralization of user-supplied filenames within the remediation verification file preview flow. Specifically, filenames are persisted and subsequently rendered into HTML and JSON attribute contexts without adequate output encoding in components such as 'fileUpload.java' and 'RemVulnData.java'. An attacker with remediation privileges can upload a file with a malicious payload in the filename; when a manager or administrator views the verification/remediation views, the payload executes in their browser. This can be leveraged for session riding to perform administrative actions like creating new privileged users or modifying platform configurations. The issue is fixed in version 1.8.3 by implementing HTML/JSON escaping and server-side filename whitelisting.

## Affected products

- factionsecurity FACTION < 1.8.3

## Timeline

- 2026-05-05: patched: Version 1.8.3 released with security fixes.
- 2026-05-26: disclosed: CVE-2026-44667 published.

## References

- [https://github.com/factionsecurity/faction/releases/tag/1.8.3](https://github.com/factionsecurity/faction/releases/tag/1.8.3)
- [https://github.com/factionsecurity/faction/security/advisories/GHSA-x3fm-rrxj-rg66](https://github.com/factionsecurity/faction/security/advisories/GHSA-x3fm-rrxj-rg66)

## Related threats

- [Faction Security FACTION stored XSS in assessment attachment filenames](https://junglewise.ai/threats/cve-2026-44669-faction-security-faction-stored-xss-in-assessment-attachment)