Stored Cross-Site Scripting Vulnerability in FACTION PenTesting Framework

CVE-2026-44667

What is CVE-2026-44667?

FACTION is a robust PenTesting Report Generation and Collaboration Framework. Before version 1.8.3, it was susceptible to stored cross-site scripting (XSS) vulnerabilities via the manipulation of attachment filenames during remediation verification file previews. The vulnerability arises because user-supplied filename values are stored and later rendered into HTML without proper encoding, which allows an attacker to inject JavaScript that executes in the browsers of users accessing affected remediation views. This flaw can have serious implications, especially for privileged accounts, as the malicious payload is stored server-side, leading to persistent exploitation. The issue has been addressed in version 1.8.3.

References