CVE-2026-44669: Faction Security FACTION stored XSS in assessment attachment filenames

CVE-2026-44669 · Severity: high · CVSS 8.7 · Published 2026-05-26

FACTION is a collaboration framework used by security teams to manage penetration testing reports. A vulnerability in the file upload system allows an attacker to embed malicious code within the name of an uploaded file. When a manager or administrator views the assessment report, this code executes automatically in their browser, potentially allowing the attacker to hijack their session, create new administrative accounts, or steal sensitive security data.

Technologies: Faction Security FACTION. Vendors: Faction Security.

Quick answers

Is CVE-2026-44669 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44669 being exploited in the wild.
How severe is CVE-2026-44669?
High severity, with a CVSS score of 8.7, published 26 May 2026.
Which products and versions are affected?
Faction Security FACTION < 1.8.3.
Is there a fix for CVE-2026-44669?
A patch was published on 2026-05-05: Version 1.8.3 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44669 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44669?
Check whether you run Faction Security FACTION at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in FACTION's assessment attachment workflow. The root cause is the improper neutralization of user-supplied filenames in 'FileUploadManager.java', which are persisted and subsequently rendered into HTML and JSON contexts without adequate output encoding. Specifically, the 'fileinput.js' component performs raw token substitution, allowing an attacker to inject JavaScript via a crafted filename (e.g., using 'onerror' attributes). An attacker with low-privileged access can upload a malicious file to an assessment; when a high-privileged user (Manager or Admin) views the assessment overview or preview, the payload executes in their security context. This can lead to full administrative takeover through session riding and unauthorized API actions. The issue is fixed in version 1.8.3 by implementing HTML/JSON escaping and a filename whitelist.

Affected products

  • Faction Security FACTION < 1.8.3

Timeline

  • 2026-05-05: patched: Version 1.8.3 released with security fixes
  • 2026-05-26: advisory: GitHub Security Advisory published
  • 2026-05-26: disclosed: CVE-2026-44669 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.