FACTION is vulnerable to a high‑severity stored XSS flaw that occurs when an attacker uploads a remediation verification attachment with a specially crafted filename. The filename is persisted on the server and subsequently injected into HTML and attribute contexts without any form of output encoding, allowing the attacker to execute arbitrary JavaScript in the browser of any user who views the affected attachment preview. Because the payload is stored server‑side, the vulnerability is replayable and can impact accounts with elevated privileges.

The flaw affects the FACTION PenTesting Report Generation and Collaboration Framework prior to version 1.8.3. Any installation that has not applied the 1.8.3 update and still uses the legacy attachment preview rendering path is exposed.

The CVSS score of 8.7 signals a high level of risk. The absence of an EPSS score does not quantify exploitation probability, but the persistent nature of the flaw and its impact on privileged users make exploitation of interest. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly documented exploit. The likely attack vector is the file upload feature of the remediation verification flow, requiring an authenticated user with permission to upload attachments.