Threat database

CVE-2026-44977 is a critical cross-site scripting (XSS) vulnerability in the Countly countly-server product analytics solution. The flaw exists in the star-rating plugin's API and frontend components prior to versions 24.05.50 and 25.03.44. It allows a non-global application administrator to upload attacker-controlled active content with a trusted MIME type, which is then served with the attacker-influenced Content-Type. When a global administrator previews this content, the malicious payload executes in the Countly origin, exposing authenticated session tokens including auth_token and csrf_token. This vulnerability has a CVSS score of 9.0 and is fixed in the specified versions.

CVE-2026-41582 is a path traversal vulnerability in countly-server, the server-side component of the Countly analytics platform. Versions prior to 24.05.50 and 25.03.44 allow unauthenticated attackers to traverse outside intended asset directories via certain public image and screenshot routes. This can lead to disclosure of arbitrary readable server files. The issue is fixed in versions 24.05.50 and 25.03.44.

CVE-2026-42270 is a vulnerability in countly-server, the server-side component of the Countly analytics platform. Prior to versions 24.05.50 and 25.03.44, certain public image and screenshot routes use local filesystem storage and call getStream to pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request with a URL-encoded dot can cause createReadStream to open a directory, triggering an asynchronous EISDIR error that is unhandled, leading to termination of the Node.js process. This results in denial of service by making the analytics API unavailable. The issue affects routes such as star-rating/images/, dashboards/images/screenshots/, /appimages/*, /memberimages/*, and */screenshots/*. The vulnerability is fixed in versions 24.05.50 and 25.03.44.

CVE-2026-42269 is a path traversal vulnerability in countly-server's data migration deletion route that allows authenticated users with migration permissions to delete arbitrary writable files or directories. This occurs because the exportid parameter is not properly validated before being used in file path operations. The issue is fixed in versions 24.05.50 and 25.03.44.

An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested array is a sub-pipeline by checking if every element contains a key present in a hardcoded KNOWN_STAGE_OPERATORS set. If any element contains an unrecognized stage key, such as the undocumented MongoDB-internal $_internalInhibitOptimization, the sanitizer misclassifies the entire branch as a generic array and skips stage-level stripping for all sibling stages. This allows a non-admin user with DBViewer read permission to inject forbidden operators like $lookup inside $facet sub-pipelines, performing cross-collection joins into restricted collections. This leads to unauthorized read access to sensitive data including password-reset tokens (prid), enabling account takeover.