Factionsecurity Faction vulnerabilities

CVE-2025-66022 [CRITICAL] CWE-287 CVE-2025-66022: FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an ex FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework permits untrusted extension code to execute arbitrary system commands on the server when a lifecycle hook is invoked, resulting in remote code execution (RCE) on the host running Faction. Due t

CVE-2026-44668 [CRITICAL] CWE-306 CVE-2026-44668: FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControl FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControlInterceptor, the authentication gate for all Struts2 actions, unconditionally calls invocation.invoke() without checking for a valid session. Four action methods in BoilerPlateConfig perform no local session check either, allowing an unauthenticated

CVE-2025-27422 [HIGH] CWE-287 CVE-2025-27422: FACTION is a PenTesting Report Generation and Collaboration Framework. Authentication is bypassed wh FACTION is a PenTesting Report Generation and Collaboration Framework. Authentication is bypassed when an attacker registers a new user with admin privileges. This is possible at any time without any authorization. The request must follow the validation rules (no missing information, secure password, etc) but there are no other controls stopping them.

CVE-2026-44667 [HIGH] CWE-79 CVE-2026-44667: FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, Faction is vu FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, Faction is vulnerable to stored cross-site scripting (XSS) via attachment filenames in remediation verification file preview flows. User-supplied filename values are persisted and then rendered into HTML and attribute contexts without output encoding, allowing attack

CVE-2026-44669 [HIGH] CWE-79 CVE-2026-44669: FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, Faction is vu FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, Faction is vulnerable to stored cross-site scripting (XSS) via attachment filenames in assessment file preview flows. User-supplied filename values are persisted and later rendered into HTML/attribute contexts without output encoding, allowing attacker-controlled Jav