CVE-2026-44729

Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using fileStream.pipe(res) without setting any Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an authenticated attacker to upload an HTML file containing JavaScript, which will be rendered by the victim's browser in the context of the Twenty CRM domain when accessed — enabling session hijacking, account takeover, and data theft.

CVSS v3 8.7 HIGH

8.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/twentyhq/twenty/security/advisories/GHSA-f5h2-3qw5-3qp7	Exploit Mitigation Vendor Advisory
https://github.com/twentyhq/twenty/security/advisories/GHSA-f5h2-3qw5-3qp7	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:twenty:twenty:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-26 17:16

Updated : 2026-07-24 11:10

NVD link : CVE-2026-44729

Mitre link : CVE-2026-44729

CVE.ORG link : CVE-2026-44729

JSON object : View

Products Affected

twenty

twenty

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-44729", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44729", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-27T13:49:29.782751Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "twentyhq", "product": "twenty", "versions": [{"status": "affected", "version": "<= 1.18.0"}]}]}], "published": "2026-05-26T17:16:46.837", "references": [{"url": "https://github.com/twentyhq/twenty/security/advisories/GHSA-f5h2-3qw5-3qp7", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/twentyhq/twenty/security/advisories/GHSA-f5h2-3qw5-3qp7", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using fileStream.pipe(res) without setting any Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an authenticated attacker to upload an HTML file containing JavaScript, which will be rendered by the victim's browser in the context of the Twenty CRM domain when accessed \u2014 enabling session hijacking, account takeover, and data theft."}, {"lang": "es", "value": "Twenty es un CRM de c\u00f3digo abierto. En la versi\u00f3n 1.18.0 y anteriores, los puntos finales de servicio de archivos en Twenty CRM en /files/* y /file/:fileFolder/:id sirven archivos subidos usando fileStream.pipe(res) sin establecer ning\u00fan encabezado de respuesta Content-Type, Content-Disposition o X-Content-Type-Options. Esto permite a un atacante autenticado subir un archivo HTML que contenga JavaScript, el cual ser\u00e1 renderizado por el navegador de la v\u00edctima en el contexto del dominio de Twenty CRM cuando se acceda a \u00e9l - lo que posibilita el secuestro de sesi\u00f3n, la toma de control de cuenta y el robo de datos."}], "lastModified": "2026-07-24T11:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:twenty:twenty:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD331BA5-5287-430D-9EE5-C3530D6415F9", "versionEndIncluding": "1.18.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}