CVE-2026-44667 is a stored cross-site scripting vulnerability in the FACTION PenTesting Report Generation and Collaboration Framework. Specifically, in versions before 1.8.3, user-supplied attachment filenames in remediation verification file previews are not properly neutralized before being rendered in HTML and attribute contexts. This allows attackers to inject and execute arbitrary JavaScript in the browsers of users who open the affected views. Because the malicious payload is stored server-side and delivered to other users, the vulnerability is persistent and can affect privileged accounts. The vulnerability has a CVSS 3.1 base score of 8.7, indicating high severity. The issue is resolved in FACTION version 1.8.3.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, potentially leading to theft of sensitive information, session hijacking, or unauthorized actions performed with the privileges of the victim user. The vulnerability is persistent and affects privileged accounts, increasing the potential impact on confidentiality and integrity. There is no indication of availability impact. No known exploits in the wild have been reported.

Upgrade FACTION to version 1.8.3 or later, where this stored XSS vulnerability has been fixed. Since the vendor advisory confirms the fix in 1.8.3, applying this official update is the recommended remediation. No other mitigation steps are specified or required.