彙總 twenty 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
常見弱點模式包括 跨站腳本、SSRF與SQL 注入，在 軟體部署與生產負載 使用場景中可能帶來 工作階段劫持與資料外洩 等風險。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2026-46624 | Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution (RCE) vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user can execute arbitrary OS commands on the database server by injecting SQL through the unsanitized timeZone parameter in the REST API groupBy endpoint. The timeZone field within the group_by query parameter is directly interpolated into a raw | [email protected] | 9.9 | 0.48% | 2026-05-26 | 2026-06-17 |
| CVE-2026-44729 | Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using fileStream.pipe(res) without setting any Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an authenticated attacker to upload an HTML file containing JavaScript, which will be rendered by the victim's browser in the context of the Twenty CRM domain when accessed — enabling session hijacking, accoun | [email protected] | 8.7 | 0.26% | 2026-05-26 | 2026-06-17 |
| CVE-2026-27023 | Twenty is an open source CRM. Prior to version 1.18, the SSRF protection in SecureHttpClientService validated request URLs at the request level but did not validate redirect targets. An authenticated user who could control outbound request URLs (e.g., webhook endpoints, image URLs) could bypass private IP blocking by redirecting through an attacker-controlled server. This issue has been patched in version 1.18. | [email protected] | 5.0 | 0.20% | 2026-03-05 | 2026-06-17 |
| CVE-2026-26720 | An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module. | [email protected] | 9.8 | 0.82% | 2026-03-02 | 2026-06-17 |
| CVE-2024-28435 | The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload. | [email protected] | 5.4 | 0.41% | 2024-03-25 | 2026-06-17 |
| CVE-2024-28434 | The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0. A crafted svg file can trigger the execution of the javascript code. | [email protected] | 7.6 | 0.67% | 2024-03-25 | 2026-06-17 |