CVE-2026-44729: Twenty Twenty CRM XSS Vulnerability

CVE-2026-44729 Overview

CVE-2026-44729 is a stored Cross-Site Scripting (XSS) vulnerability in Twenty, an open source Customer Relationship Management (CRM) platform. Versions 1.18.0 and earlier serve uploaded files through the /files/* and /file/:fileFolder/:id endpoints without setting Content-Type, Content-Disposition, or X-Content-Type-Options response headers. An authenticated attacker can upload an HTML file containing JavaScript that the victim's browser renders in the Twenty CRM origin. The flaw maps to [CWE-79] and carries a CVSS 3.1 score of 8.7.

Critical Impact
Authenticated attackers can hijack sessions, take over accounts, and exfiltrate CRM data by abusing the file-serving endpoints to deliver attacker-controlled HTML in the victim's browser context.

Affected Products

Twenty CRM versions 1.18.0 and earlier
Self-hosted deployments serving files through /files/*
Self-hosted deployments serving files through /file/:fileFolder/:id

Discovery Timeline

2026-05-26 - CVE-2026-44729 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-44729

Vulnerability Analysis

The vulnerability resides in Twenty CRM's file delivery logic. Both /files/* and /file/:fileFolder/:id stream uploaded content directly to the response using fileStream.pipe(res). The handler omits security-relevant response headers entirely.

Without an explicit Content-Type, browsers fall back to MIME sniffing. Without X-Content-Type-Options: nosniff, browsers may interpret uploaded content as HTML and execute embedded scripts. The absence of Content-Disposition: attachment means files render inline rather than downloading.

Because uploaded files are served from the Twenty CRM origin, injected JavaScript runs with full access to the victim's session cookies, local storage, and authenticated API endpoints. This enables session hijacking, account takeover, and exfiltration of CRM records.

Root Cause

The root cause is missing output hardening on a user-controlled file path. The application trusts uploaded file contents and pipes them to clients without metadata describing how the browser should interpret them. Authentication on the upload endpoint does not mitigate the issue, since any authenticated tenant user can deliver the payload to other users.

Attack Vector

An authenticated attacker uploads an HTML document containing a JavaScript payload to the CRM. The attacker then shares the resulting file URL with a victim user of the same Twenty instance. When the victim opens the link, the browser renders the HTML in the Twenty origin and executes the script. The payload can read the victim's session, issue authenticated API requests, and exfiltrate data to an attacker-controlled host.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-f5h2-3qw5-3qp7 for vendor technical details.

Detection Methods for CVE-2026-44729

Indicators of Compromise

Uploaded files with .html, .htm, .svg, or .xhtml extensions stored in Twenty's file storage backend.
HTTP responses from /files/* or /file/:fileFolder/:id missing Content-Type and X-Content-Type-Options headers.
Outbound requests from user browsers to unfamiliar domains immediately after accessing a Twenty file URL.
Session cookies or API tokens appearing in web server access logs as query parameters to external endpoints.

Detection Strategies

Inspect Twenty CRM access logs for GET requests to /files/ or /file/ returning responses without a Content-Type header.
Scan the file storage backend for uploaded objects whose contents begin with <html, <script, or <svg regardless of extension.
Correlate file upload events with subsequent file fetches from different user accounts to identify potential payload delivery.

Monitoring Recommendations

Enable web application firewall (WAF) logging in front of Twenty CRM and alert on responses lacking X-Content-Type-Options: nosniff.
Monitor authenticated upload activity for users posting HTML or SVG content to the CRM.
Track anomalous outbound DNS or HTTP traffic from corporate browsers shortly after Twenty CRM file access.

How to Mitigate CVE-2026-44729

Immediate Actions Required

Upgrade Twenty CRM to a version later than 1.18.0 that addresses GHSA-f5h2-3qw5-3qp7.
Restrict upload permissions to trusted users until the patch is applied.
Audit existing uploads for HTML, SVG, or other markup payloads and remove suspicious files.
Rotate session secrets and force re-authentication if compromise is suspected.

Patch Information

The vendor published advisory GHSA-f5h2-3qw5-3qp7 describing the fix. Administrators should consult the advisory for the specific fixed release and apply it to all Twenty CRM deployments running 1.18.0 or earlier.

Workarounds

Place a reverse proxy in front of Twenty CRM that injects Content-Type: application/octet-stream, Content-Disposition: attachment, and X-Content-Type-Options: nosniff for /files/* and /file/* responses.
Serve uploaded files from a separate sandbox domain so that script execution cannot access the CRM origin's cookies or storage.
Block uploads of HTML, SVG, and other active-content MIME types at the application or WAF layer.

bash

# Example nginx reverse proxy hardening for Twenty CRM file endpoints
location ~ ^/(files|file)/ {
    proxy_pass http://twenty_backend;
    proxy_hide_header Content-Type;
    add_header Content-Type "application/octet-stream" always;
    add_header Content-Disposition "attachment" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Security-Policy "default-src 'none'; sandbox" always;
}