SB20260728112 - Cross-site scripting in Twenty

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260728112

SB20260728112 - Cross-site scripting in Twenty

Published: July 28, 2026

Security Bulletin ID SB20260728112
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Cross-site scripting (CVE-ID: CVE-2026-44729)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in the victim's browser and disclose sensitive information.

The vulnerability exists due to cross-site scripting in the file serving endpoints at /files/* and /file/:fileFolder/:id when serving uploaded files without setting safe response headers. A remote user can upload a crafted HTML file and cause a victim to open its URL to execute arbitrary script in the victim's browser and disclose sensitive information.

User interaction is required, and the issue is exploitable in deployments where the response is rendered inline without protective header injection by upstream infrastructure.


Remediation

Install update from vendor's website.

References