Vulnerability details
CVE-2025-66022
factionsecurity faction
FACTION Unauthenticated Custom Extension Upload leads to RCE
CVSS 3.1
9.7Critical
Official description
FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework permits untrusted extension code to execute arbitrary system commands on the server when a lifecycle hook is invoked, resulting in remote code execution (RCE) on the host running Faction. Due to a missing authentication check on the /portal/AppStoreDashboard endpoint, an attacker can access the extension management UI and upload a malicious extension without any authentication, making this vulnerability exploitable by unauthenticated users. This issue has been patched in version 1.7.1.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.7Critical | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| factionsecurity | faction | < 1.7.1 | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-11-26
- Last updated
- 2025-11-26
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.71%
Probability of exploitation in 30 days
54%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-829Inclusion of Functionality from Untrusted Control Sphere
- CWE-287Improper Authentication