Threat database

CVE-2026-44668 is a critical vulnerability in the factionsecurity faction product 'faction' prior to version 1.8.3. The issue arises because the AccessControlInterceptor, which is supposed to authenticate all Struts2 actions, does not verify session validity before invoking actions. Additionally, four methods in BoilerPlateConfig lack local session checks, allowing unauthenticated attackers to read, modify, deactivate, or delete boilerplate templates. This vulnerability has a CVSS score of 9.8, indicating a high risk of confidentiality, integrity, and availability impact. The vulnerability is fixed in version 1.8.3.

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, Faction is vulnerable to stored cross-site scripting (XSS) via attachment filenames in assessment file preview flows. User-supplied filename values are persisted and later rendered into HTML/attribute contexts without output encoding, allowing attacker-controlled JavaScript to execute in the browser of any user who views the affected page. Because the payload is stored server-side and rendered to other users, exploitation is persistent and can impact privileged accounts. This vulnerability is fixed in 1.8.3.

FACTION versions prior to 1.8.3 are affected by a stored cross-site scripting (XSS) vulnerability in the remediation verification file preview feature. The vulnerability arises because attachment filenames supplied by users are stored and rendered without proper output encoding, allowing attacker-controlled JavaScript to execute in the browsers of users who view these files. This persistent XSS can impact privileged users and lead to high confidentiality and integrity risks. The issue is fixed in version 1.8.3.

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework permits untrusted extension code to execute arbitrary system commands on the server when a lifecycle hook is invoked, resulting in remote code execution (RCE) on the host running Faction. Due to a missing authentication check on the /portal/AppStoreDashboard endpoint, an attacker can access the extension management UI and upload a malicious extension without any authentication, making this vulnerability exploitable by unauthenticated users. This issue has been patched in version 1.7.1.