EUVD-2026-31943Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, Faction is vulnerable to stored cross-site scripting (XSS) via attachment filenames in assessment file preview flows. User-supplied filename values are persisted and later rendered into HTML/attribute contexts without output encoding, allowing attacker-controlled JavaScript to execute in the browser of any user who views the affected page. Because the payload is stored server-side and rendered to other users, exploitation is persistent and can impact privileged accounts. This vulnerability is fixed in 1.8.3.
AnalysisAI
Stored cross-site scripting in Faction (a penetration testing report generation and collaboration framework) versions prior to 1.8.3 allows authenticated low-privilege users to persist attacker-controlled JavaScript via attachment filenames that are later rendered without output encoding when other users preview assessment files. Because payloads execute in privileged victims' browsers under the application origin, an attacker can hijack manager or admin sessions; SSVC rates technical impact as total though EPSS sits at 0.03% (10th percentile) and no public exploit identified at time of analysis.
Technical ContextAI
Faction is a Java-based collaboration platform used by penetration testing teams to author, store, and finalize client deliverables. The flaw is a classic CWE-79 stored XSS: per the 1.8.3 release notes, filenames returned in upload responses were not context-appropriately escaped, so values reaching HTML attribute, JSON, or URL contexts could carry script payloads. The fix introduces escapeHtml4 for HTML attribute contexts, escapeJson for JSON strings, URLEncoder for URL parameters, plus server-side whitelist validation (alphanumeric, spaces, dots, hyphens, underscores) that rejects HTML or script characters at upload time. CPE coverage (cpe:2.3:a:factionsecurity:faction:*) confirms all versions below 1.8.3 across the single vendor product line are in scope.
RemediationAI
Vendor-released patch: upgrade Faction to 1.8.3 or later, available at https://github.com/factionsecurity/faction/releases/tag/1.8.3, which adds context-appropriate output encoding (escapeHtml4, escapeJson, URLEncoder) and a server-side filename whitelist rejecting HTML and script characters; review the advisory at https://github.com/factionsecurity/faction/security/advisories/GHSA-f2jc-wx44-mr54 for full details. If immediate upgrade is not possible, restrict account creation and tightly review who holds assessor/manager roles since exploitation requires an authenticated low-privilege session, and consider a reverse-proxy or WAF rule that blocks uploads whose multipart filename contains '<', '>', '"', or 'script' (trade-off: legitimate filenames containing angle brackets or quoted segments will be rejected, and proxy-layer filtering does not address filenames already persisted in the database, which should be audited and renamed). A strict Content-Security-Policy that disallows inline script would reduce blast radius but typically requires application changes to deploy on Faction without breaking the UI.
FACTION is a PenTesting Report Generation and Collaboration Framework. Rated critical severity (CVSS 9.6), this vulnerab
Unauthenticated authorization bypass in FACTION pentesting report framework prior to 1.8.3 allows remote attackers to re
Stored cross-site scripting in Faction penetration testing platform versions prior to 1.8.3 allows authenticated users t
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today