Read the docs
TI-2026-75338 Aliases CVE-2026-41582

Path traversal in countly-server exposes arbitrary server files

Priority HIGH 72CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

countly-server versions before 24.05.50 and from 25.03 before 25.03.44 are affected. Public image and screenshot routes concatenate attacker-controlled wildcard paths without containment checks, which is a path traversal flaw (CWE-22). On deployments using the local filesystem backend, an unauthenticated remote attacker can read arbitrary readable files on the server.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00527 44th percentileScored 2026-11-07
Fix Fixed countly-server (Countly): 24.05.50, 25.03.44

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Countlycountly-serverbefore 24.05.50; 25.03 to before 25.03.4424.05.50, 25.03.44Patch availableCNA
  • countly-server VendorCountly Affected before 24.05.50; 25.03 to before 25.03.44 Fixed in 24.05.50, 25.03.44 Patch available CNA

Remediation

Update countly-server to version 24.05.50 if you run a release before 24.05.50, or to version 25.03.44 if you run a 25.03 release before 25.03.44.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA countly-server (Countly) Fixed in 24.05.50, 25.03.44

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-41582
  2. 2026-10-18 Priority changed: MEDIUM → LOW
  3. 2026-10-19 CISA SSVC decision points changed
  4. 2026-10-19 Priority changed: LOW → HIGH

References

Other 5

  • TI-2026-75341 Stored XSS in countly-server feedback upload exposes global admin session CVSS 3.1CRITICAL 9.0
  • TI-2026-75340 Unauthenticated denial of service in countly-server image routes CVSS 3.1HIGH 7.5
  • TI-2026-75339 Path traversal in countly-server lets users delete files CVSS 3.1HIGH 8.1
  • TI-2026-59922 Incorrect authorization in countly-server CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences