CVE-2026-42270: CWE-248: Uncaught Exception in Countly countly-server

The vulnerability in countly-server affects public image and screenshot routes that use the local filesystem backend. Specifically, routes such as star-rating/images/, dashboards/images/screenshots/, /appimages/*, /memberimages/*, and */screenshots/* call getStream and pipe filesystem streams to HTTP responses without attaching an error listener. An unauthenticated request containing a URL-encoded dot can cause createReadStream to open a directory instead of a file, which emits an asynchronous EISDIR error. Because this error is unhandled, it causes the Node.js process to terminate unexpectedly. Repeated exploitation can keep the analytics API unavailable, resulting in a denial of service condition. The vulnerability is tracked as CVE-2026-42270 and is classified under CWE-248 (Uncaught Exception). It has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts availability only. The issue is fixed in countly-server versions 24.05.50 and 25.03.44.

Successful exploitation causes the Node.js process running countly-server to terminate due to an unhandled asynchronous EISDIR error. This results in denial of service by making the analytics API unavailable until the service is restarted. There is no impact on confidentiality or integrity. The vulnerability can be triggered by unauthenticated remote attackers via crafted HTTP requests to specific image and screenshot routes.

This vulnerability is fixed in countly-server versions 24.05.50 and 25.03.44. Users should upgrade to these or later versions to remediate the issue. No other mitigation or workaround is indicated by the vendor advisory.