CVE-2025-66022

CVE-2025-66022 affects FACTION prior to 1.7.1. An unauthenticated extension upload via the /portal/AppStoreDashboard endpoint, plus an extension execution path in the extension framework, permits untrusted code to execute arbitrary system commands on the server, enabling remote code execution on ...