CVE-2026-42269 in Server
Summary
by MITRE • 10/16/2026
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees and cause data loss or service disruption. This issue is fixed in versions 24.05.50 and 25.03.44.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified within the Countly server-side analytics platform represents a critical path traversal flaw located specifically within the authenticated data migration module. The component responsible for handling this functionality, found in plugins/data_migration/api/api.js, exposes an endpoint designed to delete exported data during the migration process. This route accepts user-controlled input via the exportid parameter and passes it directly to a function named clean_up_data without performing any validation on the structure or content of the identifier. The absence of path sanitization allows attackers to manipulate this parameter using standard directory traversal sequences, such as dot-dot-slash characters, which are interpreted by the underlying operating system file resolution mechanisms rather than being rejected by the application logic.
The technical core of this vulnerability lies in how the data_migration_helper.js module processes the provided identifier. Instead of validating that the target path remains within a designated safe directory or applying strict allow-listing for permitted filenames, the code concatenates the user-supplied exportid directly into a file system path string. This concatenated path is then resolved relative to the application's working directory rather than being anchored securely within the intended import folder. Consequently, when the remove function is invoked recursively on this path, it operates with unrestricted access to the local file system hierarchy available to the process user account.
The operational impact of this flaw is severe for any instance running vulnerable versions prior to 24.05.50 and 25.03.44. Because the vulnerability requires authentication but only demands administrative privileges or specific migration permissions, it presents a significant risk to organizations that have not strictly segmented their user roles. An attacker with valid credentials possessing these elevated rights can exploit this mechanism to delete arbitrary writable files on the server hosting Countly. This capability extends beyond simple data loss within the analytics database; it enables the destruction of critical system configuration files, application binaries, or other sensitive data stored in accessible directories. Such actions can lead to complete service disruption, requiring manual restoration from backups and causing significant downtime for business operations reliant on real-time analytics.
This vulnerability aligns with CWE-22, which describes Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The exploitation technique involves manipulating input variables to access resources outside the intended scope, bypassing standard security controls that rely solely on application-level logic without enforcing file system boundaries. From an offensive perspective, this behavior mirrors techniques found in the MITRE ATT&CK framework under T1083, specifically File and Directory Discovery, although here it is escalated to destructive modification or deletion rather than mere reconnaissance. The recursive nature of the removal function amplifies the blast radius, potentially wiping out entire directory trees if not carefully constrained by proper input validation.
Mitigation for this issue requires immediate upgrading to Countly server version 24.05.50 or later, where the developers have implemented necessary safeguards to validate and sanitize path inputs before they are processed by file system operations. For organizations unable to upgrade immediately due to operational constraints, strict role-based access control should be enforced to ensure that only a minimal number of highly trusted administrators possess migration permissions. Additionally, running the Countly application with restricted operating system privileges can limit the scope of files accessible through path traversal attacks, reducing the potential for catastrophic data loss or service interruption until a permanent patch is applied.