CVE-2026-44729 Details
Description
Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using fileStream.pipe(res) without setting any Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an authenticated attacker to upload an HTML file containing JavaScript, which will be rendered by the victim's browser in the context of the Twenty CRM domain when accessed — enabling session hijacking, account takeover, and data theft.
A stored cross-site scripting vulnerability has been identified in Twenty CRM versions through 1.18.0. The issue arises from file serving endpoints that handle uploaded files without proper sanitization or response headers. This flaw allows an authenticated attacker to upload an HTML file containing JavaScript, which is then executed in the context of the Twenty CRM domain. The vulnerability can lead to session hijacking, account takeover, and data theft.
Users are advised to update to a version of Twenty CRM that addresses this vulnerability. The recommended fix includes setting appropriate response headers, extending file type sanitization, and implementing file type allowlisting for uploads.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/twentyhq/twenty/security/advisories/GHSA-f5h2-3qw5-3qp7 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/twentyhq/twenty/security/advisories/GHSA-f5h2-3qw5-3qp7 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| twenty twenty | <= 1.18.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | Initial Analysis | [email protected] |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | New CVE Received | [email protected] |