Twenty CRM versions 1.18.0 and earlier have an XSS vulnerability due to improper handling of uploaded files at the /files/* and /file/:fileFolder/:id endpoints. These endpoints serve files using fileStream.pipe(res) without setting security-related HTTP headers such as Content-Type, Content-Disposition, or X-Content-Type-Options. As a result, an authenticated attacker can upload an HTML file with embedded JavaScript that executes in the victim's browser context, enabling attacks like session hijacking and account takeover. The CVSS 3.1 score is 8.7, indicating high severity. No patch or official remediation has been documented yet.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of the Twenty CRM domain for other users. This can lead to session hijacking, account takeover, and theft of sensitive data. The vulnerability does not impact availability but compromises confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict file upload permissions to trusted users only and avoid accessing uploaded files from untrusted sources. Implement manual controls to validate and sanitize uploaded files and consider using web application firewalls to detect malicious payloads. Monitor vendor channels for official patches or updates.