Cross-site scripting in Twenty - CVE-2026-44729
Published: July 28, 2026
Vulnerability identifier: #VU139927
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-44729
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Twenty
Affected software:
Twenty
Twenty
Detailed vulnerability description
The vulnerability allows a remote user to execute arbitrary script in the victim's browser and disclose sensitive information.
The vulnerability exists due to cross-site scripting in the file serving endpoints at /files/* and /file/:fileFolder/:id when serving uploaded files without setting safe response headers. A remote user can upload a crafted HTML file and cause a victim to open its URL to execute arbitrary script in the victim's browser and disclose sensitive information.
User interaction is required, and the issue is exploitable in deployments where the response is rendered inline without protective header injection by upstream infrastructure.
How to mitigate CVE-2026-44729
Install security update from vendor's website.