CVE-2025-66022

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2025-66022

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66022.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-66022

Aliases

GHSA-xr72-2g43-586w

Published

2025-11-26T02:08:14.805Z

Modified

2025-11-28T03:00:21.760374Z

Severity

9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

FACTION Unauthenticated Custom Extension Upload leads to RCE

Details

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework permits untrusted extension code to execute arbitrary system commands on the server when a lifecycle hook is invoked, resulting in remote code execution (RCE) on the host running Faction. Due to a missing authentication check on the /portal/AppStoreDashboard endpoint, an attacker can access the extension management UI and upload a malicious extension without any authentication, making this vulnerability exploitable by unauthenticated users. This issue has been patched in version 1.7.1.

Database specific

{
    "cwe_ids": [
        "CWE-287",
        "CWE-829"
    ]
}

References

Affected packages

Git / github.com/factionsecurity/faction

Affected ranges

Type: GIT
Repo: https://github.com/factionsecurity/faction
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

ed0383686732f4ba6adb73bc004495918aaae074

Affected versions

1.*

1.1.0

1.1.1

1.1.10

1.1.11

1.1.12

1.1.13

1.1.14

1.1.15

1.1.16

1.1.17

1.1.18

1.1.19

1.1.2

1.1.20

1.1.21

1.1.22

1.1.23

1.1.24

1.1.24.0

1.1.24.1

1.1.24.2

1.1.24.3

1.1.25

1.1.25.0

1.1.25.1

1.1.26.0

1.1.26.1

1.1.26.2

1.1.27

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.3.0

1.3.1

1.3.2

1.3.20

1.3.21

1.3.22

1.3.23

1.3.24

1.3.25

1.3.26

1.3.27

1.3.28

1.3.29

1.3.3

1.3.32

1.3.33

1.3.34

1.3.35

1.3.36

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.5.0

1.5.1

1.5.2

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.6.8

1.7.0