CVE-2026-41582: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Countly countly-server

Countly-server versions before 24.05.50 and between 25.03 and 25.03.44 contain a CWE-22 path traversal vulnerability in public image and screenshot routes implemented in frontend/express/app.js and certain plugins. These routes concatenate attacker-controlled wildcard paths without containment validation, enabling unauthenticated attackers on local filesystem backend deployments to traverse outside intended asset directories. This leads to disclosure of arbitrary readable server files via getStats or getStream functions in api/utils/countlyFs.js. Affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. The vulnerability is resolved in versions 24.05.50 and 25.03.44.

An unauthenticated attacker can exploit this vulnerability to read arbitrary files on the server filesystem in deployments using the local filesystem backend. This can lead to disclosure of sensitive server files, impacting confidentiality. There is no impact on integrity or availability. The CVSS v3.1 score is 7.5 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

This vulnerability is fixed in countly-server versions 24.05.50 and 25.03.44. Users should upgrade to at least these versions to remediate the issue. No additional mitigations are indicated by the vendor advisory.