Read the docs
TI-2026-75340 Aliases CVE-2026-42270

Unauthenticated denial of service in countly-server image routes

Priority HIGH 72CWE-248Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-248.

Summary

countly-server, the server-side part of Countly, is affected before 24.05.50 and from 25.03 before 25.03.44. Public image and screenshot routes that use the local file storage backend pipe filesystem streams to HTTP responses without an error listener (CWE-248). An unauthenticated remote attacker can send a request with a URL-encoded dot so that a directory is opened, which raises an unhandled exception that terminates the Node.js process. Repeated requests keep the analytics API unavailable.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception, allowing repeated requests to keep the analytics API unavailable. The affected routes also include /appimages/*, /memberimages/*, and */screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00542 45th percentileScored 2026-11-07
Fix Fixed countly-server (Countly): 24.05.50, 25.03.44

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Countlycountly-serverbefore 24.05.50; 25.03 to before 25.03.4424.05.50, 25.03.44Patch availableCNA
  • countly-server VendorCountly Affected before 24.05.50; 25.03 to before 25.03.44 Fixed in 24.05.50, 25.03.44 Patch available CNA

Remediation

Upgrade countly-server to version 24.05.50 or 25.03.44, which fix this issue. CISA has not added this vulnerability to its Known Exploited Vulnerabilities catalog.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA countly-server (Countly) Fixed in 24.05.50, 25.03.44

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-42270
  2. 2026-10-16 CISA SSVC decision points changed
  3. 2026-10-16 Priority changed: MEDIUM → HIGH

References

Other 5

  • TI-2026-75341 Stored XSS in countly-server feedback upload exposes global admin session CVSS 3.1CRITICAL 9.0
  • TI-2026-75338 Path traversal in countly-server exposes arbitrary server files CVSS 3.1HIGH 7.5
  • TI-2026-75339 Path traversal in countly-server lets users delete files CVSS 3.1HIGH 8.1
  • TI-2026-59922 Incorrect authorization in countly-server CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences