CVE-2026-44729

Name of the Vulnerable Software and Affected Versions Twenty versions prior to 1.18.1

Description An issue exists in the file serving endpoints '/files/*' and '/file/:fileFolder/:id' where uploaded files are served using fileStream.pipe(res) without specifying Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an authenticated attacker to upload an HTML file containing JavaScript that the victim's browser will render within the context of the domain, potentially leading to session hijacking, account takeover, and data theft.

Recommendations Update to a version later than 1.18.0.