CVE-2026-41582 in countly-server
Summary
by MITRE • 10/16/2026
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/16/2026
Countly-server serves as the server-side component of Countly, a comprehensive product analytics platform designed to collect and analyze user interaction data. The vulnerability identified within this software stems from improper handling of file paths in several frontend-facing routes that are responsible for serving public images, screenshots, and star rating assets. Specifically, the code modules located at frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js implement route handlers that accept user-supplied input as part of a URL path structure. These inputs are concatenated directly with base directory paths to locate files on the server's local filesystem without performing adequate validation or sanitization checks. This architectural flaw creates a classic Path Traversal vulnerability, allowing an attacker to manipulate the file system navigation sequence by injecting special characters such as dot-dot-slash sequences into the request parameters.
The operational impact of this vulnerability is significant for deployments that utilize the local filesystem backend rather than cloud storage solutions like Amazon S3 or Azure Blob Storage. Because the application fails to contain user-controlled input within the intended asset directories, an unauthenticated attacker can craft malicious HTTP requests targeting specific endpoints such as /appimages/, /memberimages/, /screenshots/, /star-rating/images/, and /dashboards/images/screensshots/. By exploiting these routes, the attacker forces the server to resolve file paths that escape the designated public folders. The request is then passed down to internal utility functions in api/utils/countlyFs.js, specifically getStats or getStream, which attempt to access the resolved path on the disk. Consequently, this allows for the arbitrary reading of sensitive files residing anywhere on the server's filesystem where the application process has read permissions.
This exposure can lead to severe information disclosure incidents. An attacker could potentially retrieve configuration files containing database credentials, API keys, or internal network topology details. They might also access source code repositories, private user data stored in unexpected locations, or other critical system binaries and logs. The lack of authentication requirement means that any external actor on the internet can exploit this flaw without needing valid login credentials, significantly lowering the barrier to entry for attackers. This aligns with Common Weakness Enumeration identifier CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within file names that could cause files to be located outside of the intended directory.
From a threat modeling perspective using the MITRE ATT&CK framework, this vulnerability facilitates Initial Access and Collection phases through techniques associated with Local File Inclusion or Path Traversal attacks. The attacker leverages the web application as an intermediary to read local resources, effectively turning the analytics server into a proxy for file exfiltration. To mitigate this risk, organizations running affected versions of Countly-server must upgrade immediately to version 24.05.50 or later, which includes patches that enforce strict path validation and containment checks before accessing files on the disk. Additionally, administrators should ensure that the application runs with minimal filesystem privileges, restricting read access only to necessary asset directories, thereby limiting the blast radius even if a traversal attempt occurs. Regular security audits of file handling logic in web applications are recommended to prevent similar implementation errors in future updates or custom plugins.