CVE-2026-44669 is a stored XSS vulnerability in the Faction PenTesting Report Generation and Collaboration Framework before version 1.8.3. It occurs because attachment filenames supplied by users are persisted and rendered into HTML/attribute contexts without proper output encoding, enabling execution of malicious JavaScript in the browsers of users viewing the affected assessment file preview pages. This persistent XSS can impact privileged users due to the stored nature of the payload. The vulnerability is resolved in Faction version 1.8.3.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of users viewing the affected pages, potentially leading to session hijacking, privilege escalation, or unauthorized actions performed with the victim's privileges. Because the payload is stored server-side and rendered to other users, the impact is persistent and can affect privileged accounts. There is no indication of known exploits in the wild at this time.

Upgrade Faction to version 1.8.3 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Patch status is not explicitly stated but the vendor has fixed the issue in 1.8.3, so applying this update is the recommended mitigation.