PT-2025-48124 · Faction · Faction

Published

2025-11-25

·

Updated

2026-01-02

·

CVE-2025-66022

CVSS v3.1

10

Critical

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions FACTION versions prior to 1.7.1
Description FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, a flaw in the extension framework allows untrusted extension code to execute arbitrary system commands on the server when a lifecycle hook is invoked, leading to remote code execution (RCE). A missing authentication check on the /portal/AppStoreDashboard endpoint allows an attacker to access the extension management UI and upload a malicious extension without authentication. This makes the issue exploitable by unauthenticated users.
Recommendations Versions prior to 1.7.1 should be updated to version 1.7.1.

Exploit

Fix

RCE

Improper Authentication

Missing Authorization

Weakness Enumeration

CWE-287CWE-862CWE-829

Related Identifiers

BDU:2025-14802
CVE-2025-66022
GHSA-XR72-2G43-586W

Affected Products

Faction