Executive brief
FACTION is a collaboration framework used by security teams to manage penetration testing reports. A vulnerability in the file upload system allows an attacker to embed malicious code within the name of an uploaded file. When a manager or administrator views the assessment report, this code executes automatically in their browser, potentially allowing the attacker to hijack their session, create new administrative accounts, or steal sensitive security data.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in FACTION's assessment attachment workflow. The root cause is the improper neutralization of user-supplied filenames in 'FileUploadManager.java', which are persisted and subsequently rendered into HTML and JSON contexts without adequate output encoding. Specifically, the 'fileinput.js' component performs raw token substitution, allowing an attacker to inject JavaScript via a crafted filename (e.g., using 'onerror' attributes). An attacker with low-privileged access can upload a malicious file to an assessment; when a high-privileged user (Manager or Admin) views the assessment overview or preview, the payload executes in their security context. This can lead to full administrative takeover through session riding and unauthorized API actions. The issue is fixed in version 1.8.3 by implementing HTML/JSON escaping and a filename whitelist.
Affected products
- Faction Security FACTION < 1.8.3
Timeline
- 2026-05-05: patched: Version 1.8.3 released with security fixes
- 2026-05-26: advisory: GitHub Security Advisory published
- 2026-05-26: disclosed: CVE-2026-44669 published to NVD