CVE-2026-44729 Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)
An authenticated attacker can upload malicious HTML files that execute JavaScript in victims' browsers due to missing security headers, enabling account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-44729?
CVE-2026-44729 is a high-severity cross-site scripting vulnerability in twentyhq twenty, published on 26 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using fileStream.pipe(res) without setting any Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an authenticated attacker to upload an HTML file containing JavaScript, which will be rendered by the victim's browser in the context of the Twenty CRM domain when accessed — enabling session hijacking, account takeover, and data theft.
Weakness: CWE-79
Which versions are affected by CVE-2026-44729?
It affects 1 product.
Products include Twenty Twenty.
How do I fix CVE-2026-44729?
No fix has been published for CVE-2026-44729 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-44729 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44729 exists.
Other vulnerabilities in twentyhq twenty
Sources
Also known as GHSA-f5h2-3qw5-3qp7.