PT-2025-48124 · Faction · Faction

Published 2025-11-26 · Updated 2025-11-28 · CVE-2025-66022

Positive Technologies · (AI Summary)

CVSS v3.1

9.6

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FACTION versions prior to 1.7.1

Description FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, a flaw in the extension framework allows untrusted extension code to execute arbitrary system commands on the server when a lifecycle hook is invoked, leading to remote code execution (RCE). A missing authentication check on the

/portal/AppStoreDashboard

endpoint allows an attacker to access the extension management UI and upload a malicious extension without authentication. This makes the issue exploitable by unauthenticated users.

Recommendations Versions prior to 1.7.1 should be updated to version 1.7.1.

Exploit

Fix

RCE

Improper Authentication

Weakness Enumeration

CWE-287

CWE-829

Related Identifiers

CVE-2025-66022

GHSA-XR72-2G43-586W

Affected Products

Faction

References · 12

• 🔥 https://github.com/factionsecurity/faction/security/advisories/GHSA-xr72-2g43-586w · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66022 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66022 · Vendor Advisory
• https://github.com/factionsecurity/faction/commit/c6389f1c76175b7c1c68d1a87b389311b16c62c3 · Note
• https://t.me/CVEtracker/38259 · Telegram Post
• https://twitter.com/0dayPublishing/status/1993510028473401378 · Twitter Post
• https://twitter.com/CCBalert/status/1993699908159725955 · Twitter Post
• https://twitter.com/elitebaz_/status/1994407161087053826 · Twitter Post
• https://t.me/cveNotify/144045 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1993645082382061912 · Twitter Post
• https://twitter.com/offseq/status/1993523479564501201 · Twitter Post
• https://twitter.com/CveFindCom/status/1993525320658337800 · Twitter Post