CVE-2026-41582High· 7.5▾ Twilightcountly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/, /memberimages/, /screenshots/, /star-rating/images/, and /dashboards/images/screenshots/. This issue is fixed in versions 24.05.50 and 25.03.44.
countly-server < 24.05.50countly-server >= 25.03, < 25.03.44Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42269High· 8.1countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion
CVE-2026-42270High· 7.5countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception
CVE-2026-44977Critical· 9.0countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context
CVE-2026-87803High· 7.1An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer
CVE-2022-37906Medium· 6.5An authenticated path traversal vulnerability exists in the ArubaOS command line interface
CVE-2024-13986High· 8.8Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface