CVE-2026-44667

HIGH 8.7

Faction: Stored XSS in Remediation Verification Attachment Filename Preview Rendering

CVSS Score

8.7

EPSS Score

0.0%

EPSS Percentile

0th

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, Faction is vulnerable to stored cross-site scripting (XSS) via attachment filenames in remediation verification file preview flows. User-supplied filename values are persisted and then rendered into HTML and attribute contexts without output encoding, allowing attacker-controlled JavaScript to execute in the browser of any user who opens the affected verification/remediation views. Because the payload is stored server-side and rendered to other users, exploitation is persistent and can impact privileged accounts. This vulnerability is fixed in 1.8.3.

CWE	CWE-79
Vendor	factionsecurity
Product	faction
Published	May 26, 2026
Last Updated	May 27, 2026

Stay Ahead of the Next One

Get instant alerts for factionsecurity faction

Be the first to know when new high vulnerabilities affecting factionsecurity faction are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

factionsecurity / faction

< 1.8.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/factionsecurity/faction/security/advisories/GHSA-x3fm-rrxj-rg66 github.com: https://github.com/factionsecurity/faction/releases/tag/1.8.3