CVE-2026-44667 Details
Description
FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, Faction is vulnerable to stored cross-site scripting (XSS) via attachment filenames in remediation verification file preview flows. User-supplied filename values are persisted and then rendered into HTML and attribute contexts without output encoding, allowing attacker-controlled JavaScript to execute in the browser of any user who opens the affected verification/remediation views. Because the payload is stored server-side and rendered to other users, exploitation is persistent and can impact privileged accounts. This vulnerability is fixed in 1.8.3.
A stored cross-site scripting vulnerability has been identified in FACTION, a PenTesting report generation and collaboration framework, prior to version 1.8.3. The issue arises in the remediation verification file preview process, where user-supplied attachment filenames are saved and later displayed in HTML and attribute contexts without proper output encoding. This oversight allows for the execution of attacker-controlled JavaScript in the browsers of users who access the affected verification or remediation views. Since the injected script is stored on the server and presented to other users, the exploitation is persistent and poses a risk to accounts with elevated privileges.
Users can update to FACTION version 1.8.3, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 26, 2026CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/factionsecurity/faction/security/advisories/GHSA-x3fm-rrxj-rg66 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/factionsecurity/faction/releases/tag/1.8.3 | [email protected] | Release NotesVendor |
| https://github.com/factionsecurity/faction/security/advisories/GHSA-x3fm-rrxj-rg66 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FACTION | <= 1.8.2 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | New CVE Received | [email protected] |