Read the docs
TI-2026-75341 Aliases CVE-2026-44977

Stored XSS in countly-server feedback upload exposes global admin session

Priority HIGH 74CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

countly-server before 24.05.50, and from 25.03 before 25.03.44, is affected. The feedback file upload in the star-rating plugin stores attacker-controlled active content and trusts the supplied MIME type, which is a cross-site scripting flaw (CWE-79). An application administrator without global rights can upload such a file, and when a global administrator opens its preview, the script runs in the Countly origin and can read the session tokens auth_token and csrf_token.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values. This issue is fixed in versions 24.05.50 and 25.03.44.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00436 38th percentileScored 2026-11-07
Fix Fixed countly-server (Countly): 24.05.50, 25.03.44

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Countlycountly-serverbefore 24.05.50; 25.03 to before 25.03.4424.05.50, 25.03.44Patch availableCNA
  • countly-server VendorCountly Affected before 24.05.50; 25.03 to before 25.03.44 Fixed in 24.05.50, 25.03.44 Patch available CNA

Remediation

The fixed versions are 24.05.50 and 25.03.44.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA countly-server (Countly) Fixed in 24.05.50, 25.03.44

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-44977
  2. 2026-10-18 Priority changed: MEDIUM → LOW
  3. 2026-10-21 CISA SSVC decision points changed
  4. 2026-10-21 Priority changed: LOW → HIGH

References

Other 5

  • TI-2026-75340 Unauthenticated denial of service in countly-server image routes CVSS 3.1HIGH 7.5
  • TI-2026-75338 Path traversal in countly-server exposes arbitrary server files CVSS 3.1HIGH 7.5
  • TI-2026-75339 Path traversal in countly-server lets users delete files CVSS 3.1HIGH 8.1
  • TI-2026-59922 Incorrect authorization in countly-server CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences