CVE-2026-44667 describes a stored XSS vulnerability in factionsecurity's faction product before version 1.8.3. Specifically, attachment filenames supplied by users are stored and later rendered into HTML and attribute contexts without proper output encoding or sanitization. This flaw enables attackers to inject JavaScript that executes in the browsers of users who open the affected remediation verification views. Because the malicious script is stored server-side, the attack is persistent and can impact users with elevated privileges. The vulnerability has a CVSS 3.1 score of 8.7, indicating high severity. The issue is resolved in faction version 1.8.3.

Successful exploitation allows attacker-controlled JavaScript to run in the context of users viewing remediation verification files, potentially leading to session hijacking, privilege escalation, or other malicious actions within the application. The persistent nature of the XSS increases risk, especially to privileged users. There are no known exploits in the wild as of the published date.

Upgrade faction to version 1.8.3 or later, where this vulnerability is fixed. Since this is a product vulnerability and not a cloud service, patching the software is required to remediate the issue. Patch status is confirmed fixed in version 1.8.3.