CVE-2026-44729

Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using fileStream.pipe(res) without setting any Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an authenticated attacker to upload an HTML file containing JavaScript, which will be rendered by the victim's browser in the context of the Twenty CRM domain when accessed — enabling session hijacking, account takeover, and data theft.

• CWE-79

• https://github.com/twentyhq/twenty/security/advisories/GHSA-f5h2-3qw5-3qp7Exploit, Mitigation, Vendor Advisory
• https://github.com/twentyhq/twenty/security/advisories/GHSA-f5h2-3qw5-3qp7Exploit, Mitigation, Vendor Advisory

Published

May 26, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44722pyzipper is a replacement for Python's zipfile that can read…6.2
• CVE-2026-44723Vowpal Wabbit is a machine learning system. The workflow .gi…9.9
• CVE-2026-44724systeminformation is a System and OS information library for…7.8
• CVE-2026-44726Deno is a JavaScript, TypeScript, and WebAssembly runtime. F…9.1
• CVE-2026-44727Jupyter Server is the backend for Jupyter web applications. …5.4
• CVE-2026-44728Babel is a compiler for writing next generation JavaScript. …7.8
• CVE-2026-4473A vulnerability was detected in itsourcecode Online Doctor A…9.8
• CVE-2026-44730OpenCTI is an open source platform for managing cyber threat…7.2
• CVE-2026-44731OpenProject is open-source, web-based project management sof…4.3
• CVE-2026-44732OpenProject is open-source, web-based project management sof…4.3
• CVE-2026-44733OpenProject is open-source, web-based project management sof…5.9
• CVE-2026-44734OpenProject is open-source, web-based project management sof…6.5