CVE-2025-66022: factionsecurity faction Improper Authentication

Vulnerability summary

CVE-2025-66022 is a critical (CVSS 9.8) Improper Authentication vulnerability in factionsecurity faction. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 51.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 26-11-2025
   PublishedVulnerability first disclosed.
2. 26-11-2025
   Last modifiedVulnerability information updated.

Description

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework permits untrusted extension code to execute arbitrary system commands on the server when a lifecycle hook is invoked, resulting in remote code execution (RCE) on the host running Faction. Due to a missing authentication check on the /portal/AppStoreDashboard endpoint, an attacker can access the extension management UI and upload a malicious extension without any authentication, making this vulnerability exploitable by unauthenticated users. This issue has been patched in version 1.7.1.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
• CWE-829Inclusion of Functionality from Untrusted Control SphereThe product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.