Threat Intelligence Database

CVE-2026-44977 is a critical cross-site scripting (XSS) vulnerability in the countly-server component of Countly, a product analytics solution. The flaw exists in the star-rating plugin's API and frontend, where a non-global application administrator can upload attacker-controlled active content with a trusted MIME type. This content is then served with the attacker-influenced Content-Type to global administrators, allowing execution of malicious payloads in the Countly origin. This can expose authenticated session tokens such as auth_token and csrf_token. The vulnerability is fixed in versions 24.05.50 and 25.03.44.

CVE-2026-41582 is a path traversal vulnerability in countly-server, the server-side component of the Countly analytics platform. Prior to versions 24.05.50 and 25.03.44, certain public image and screenshot routes improperly concatenate attacker-controlled paths without validating containment. This allows unauthenticated attackers on deployments using the local filesystem backend to read arbitrary server files outside intended directories. The issue affects routes such as /appimages/*, /memberimages/*, and others related to screenshots and star-rating images. The vulnerability is fixed in versions 24.05.50 and 25.03.44.

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception, allowing repeated requests to keep the analytics API unavailable. The affected routes also include /appimages/*, /memberimages/*, and */screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees and cause data loss or service disruption. This issue is fixed in versions 24.05.50 and 25.03.44.