CVE-2025-66022 is a critical (CVSS 9.6) remote code execution flaw in Faction, the pentest report framework. Versions up to 1.7.0 let an unauthenticated user upload a malicious extension and run commands on the server. NVD says 1.7.1 fixes it, but the advisory page lists no patched version. Confirm before you rely on it.
What's affected
Faction versions before 1.7.1 are affected, according to the record. The GitHub advisory states the affected versions as 1.7.0 and below.
There is a source conflict on the fix. The record says the issue is patched in version 1.7.1 and links a fix commit. The advisory page I fetched shows "Patched versions: None". Both are in the open. If you run Faction, check the project's releases and the commit yourself and do not assume either statement alone.
The advisory describes two problems that combine. The extension management page, /portal/AppStoreDashboard, has no authentication check. And uploaded extensions, which are JAR files, are loaded and executed without code signing, validation or sandboxing. When a lifecycle hook runs, for example during report generation, the extension code runs in the application's JVM with the privileges of the server process.
Severity agrees. The record gives CVSS 3.1 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), and the advisory labels it Critical with 9.6.
How to check if you're exposed
Find the version you run. If it is a container, check the image tag. If it is a build from source, check the commit against the fix commit linked in the record.
Then check whether the application is reachable by people who should not reach it. Faction holds assessment data, templates, credentials and database contents, so it should never be exposed to the open internet. Check your firewall rules and reverse proxy.
Finally, look for signs of misuse. List the installed extensions, and check for any you did not install. Review web server logs for requests to the extension dashboard path from outside your team.
What to do now
- Move to Faction 1.7.1 or later if the project's release confirms the fix, and check the fix commit linked in the record.
- If you cannot confirm a fixed release, block access to the extension management path at your reverse proxy and restrict the whole application to a trusted network or VPN.
- List and review installed extensions. Remove any you cannot account for.
- Run Faction as an unprivileged user, since the advisory notes that full host control follows if it runs as root.
- If an exposed instance may have been abused, rotate credentials stored in it and review reports and templates for tampering.
Why it matters
Three weaknesses meet here: CWE-287 (improper authentication), CWE-862 (missing authorization) and CWE-829 (inclusion of functionality from an untrusted control sphere). An extension system is a code loader. Anyone who can upload an extension can run code, so the upload path needs the strongest access control in the application.
The data at risk is sensitive. Pentest reports contain findings about customers' systems. The advisory lists exfiltration of assessment data, tampering with reports, stopping the server or encrypting storage. The record does not say it was exploited in the wild, and the KEV flag is false. The free Safeguard dependency scan can list the packages in a project and flag known CVEs, and the Gold directory keeps a page for each one.
Quick check
Is version 1.7.1 really a fix?
The record says so and links a commit. The advisory page shows no patched version. Check the project's releases and the commit before you rely on it.
Should Faction be reachable from the internet?
The advisory describes data that is sensitive. Keep it behind a VPN or a restricted network.
Sources
Last reviewed: 18 October 2026.
