CVE-2026-44729

HighCVSS 8.7

Published: 26/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

Twenty CRM versions 1.18.0 and earlier do not set Content-Type, Content-Disposition, or X-Content-Type-Options headers when serving files. This allows an authenticated attacker to upload an HTML file with JavaScript that executes in the context of the Twenty CRM domain when accessed.

Risk Assessment

An attacker can hijack sessions, take over user accounts, and steal data, leading to full compromise of the CRM system.

Recommendation

Update Twenty CRM to a version later than 1.18.0 where proper security headers for served files have been added.

Other vulnerabilities in Twenty CRM

CVE-2026-46624Critical
Critical Remote Code Execution (RCE) vulnerability in Twenty CRM (versions 1.7.7 through 1.16.7) via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. An authenticated attacker can execute arbitrary OS commands on the database server by injecting SQL through the unsanitized timeZone parameter in the REST API groupBy endpoint.

Original NVD description (English source)

Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using fileStream.pipe(res) without setting any Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an authenticated attacker to upload an HTML file containing JavaScript, which will be rendered by the victim's browser in the context of the Twenty CRM domain when accessed — enabling session hijacking, account takeover, and data theft.