Twenty 1.18.0 and earlier expose file serving endpoints that do not set the Content‑Type, Content‑Disposition or X‑Content‑Type‑Options headers. An authenticated user can upload an HTML document containing JavaScript; when the victim later accesses the file, the browser executes the script in the context of the Twenty CRM domain. This flaw, classified as CWE‑79, can enable session hijacking, account takeover, and data exfiltration.

The vulnerable product is Twenty, the open‑source customer relationship management system from twentyhq. Versions 1.18.0 and earlier are affected. The flaw is present in the file endpoints accessed via /files/* and /file/:fileFolder/:id.

The CVSS base score of 8.7 indicates high severity. No EPSS data is published, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated attacker to upload a malicious file and a victim to request that file; therefore, it is medium‑to‑high risk in environments where users can upload files without additional scrutiny.