CVE-2026-42269: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Countly countly-server

The vulnerability exists because the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes a user-controlled exportid parameter to the clean_up_data function without validating the path. This exportid is concatenated into a file path in plugins/data_migration/api/data_migration_helper.js, which is resolved outside the intended directory and passed to a recursive remove function. This improper limitation of pathname allows an attacker with appropriate permissions to delete arbitrary files or directories, causing data loss or service disruption. Versions prior to 24.05.50 and versions from 25.03 up to but not including 25.03.44 are affected. The issue is fixed in 24.05.50 and 25.03.44.

An authenticated application administrator or user with migration permission can delete arbitrary writable files or directory trees outside the intended import directory. This can result in significant data loss or disruption of service availability. The CVSS 3.1 score is 8.1 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impact.

Upgrade countly-server to version 24.05.50 or later, or to version 25.03.44 or later. These versions contain the official fix that validates and restricts the pathname to prevent path traversal. No other mitigation is required as the vulnerability is addressed by these patches.