Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using fileStream.pipe(res) without setting any Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an authenticated attacker to upload an HTML file containing JavaScript, which will be rendered by the victim's browser in the context of the Twenty CRM domain when accessed — enabling session hijacking, account takeover, and data theft.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-26 | 2 | General2 |
| 2026-05-27 | 1 | Disclosure1 |
🔴 Twenty CRM, Stored Cross-Site Scripting (XSS), #CVE-2026-44729 (Critical) https://dailycve.com/twenty-crm-stored-cross-site-scripting-xss-cve-2026-44729-critical/
Post summary
A critical stored XSS vulnerability (CVE‑2026‑44729) has been disclosed in Twenty CRM.
🚨*CVE* CVE-2026-44729 Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using fileStr… https://www.cve.org/CVERecord?id=CVE-2026-44729 ----- Traducción: CVE-2026-44729 Twe… http://infoflow.cloud`
Post summary
The message refers to CVE-2026-44729 for an open-source CRM, noting a file-serving issue, but offers only a basic description and a link to the CVE record, with no exploit code, patch, or technical details provided.
CVE-2026-44729 Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using fileStr… https://www.cve.org/CVERecord?id=CVE-2026-44729
Post summary
The text references CVE‑2026‑44729, noting that versions 1.18.0 and earlier of Twenty CRM’s file‑serving endpoints are affected, but it provides no exploit, patch, or detailed technical data.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | twenty | twenty | - | - | - |