CVE-2026-41582highCWE-22

CVE-2026-41582: falha de alta gravidade em countly-server

countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar countly-server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.5%
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Countly · countly-server
CVEs relacionadas — countly-server

No mesmo produto, das mais perigosas para as menos.

CVE-2022-29174HIGHPredictable password reset token may lead to account takeover in countly-serverEPSS 1.5%CVE-2021-32852MEDIUMcountly-server vulnerable to Cross-site ScriptingEPSS 0.9%CVE-2026-42270HIGHcountly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream ExceptionEPSS 0.5%CVE-2026-42269HIGHcountly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory DeletionEPSS 0.5%CVE-2026-44977CRITICALcountly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session contextEPSS 0.4%CVE-2026-87803HIGHCVE-2026-87803EPSS 0.3%