Twenty CRM versions 1.18.0 and earlier have an XSS vulnerability due to improper handling of uploaded files at the /files/* and /file/:fileFolder/:id endpoints. These endpoints serve files using fileStream.pipe(res) without setting security-related HTTP headers such as Content-Type, Content-Disposition, or X-Content-Type-Options. An authenticated attacker can upload an HTML file with embedded JavaScript, which will execute in the victim's browser under the Twenty CRM domain, enabling high-impact attacks like session hijacking and account takeover. The CVSS 3.1 score is 8.7 (high severity) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. No official patch or remediation guidance is currently available.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of the victim's browser within the Twenty CRM domain. This can lead to session hijacking, account takeover, and theft of sensitive data. The vulnerability affects confidentiality and integrity but does not impact availability. The high CVSS score reflects the significant risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions to trusted users only and avoid accessing uploaded files from untrusted sources. Consider implementing manual controls to validate or sanitize uploaded files and configure web server or reverse proxy rules to enforce appropriate Content-Type and security headers when serving files.