Live › vulnerability › CVE-2026-41582
Go to dashboardCountly's public image and screenshot routes concatenate user-supplied wildcard paths without containment checks, so on local filesystem storage an unauthenticated request can escape the asset directory. An attacker can read arbitrary files the Countly process can access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Countly servers below 24.05.50 or that store assets on the local filesystem are exposed, since the traversal targets the local asset path handling. The affected routes include /appimages/, , /star-rating/images/. Teams on a patched release, or using only external object storage, can skip it.
25.03.44No product ranges from the sources yet.
24.05.50 and 25.03.44./appimages/../../../../etc/passwd or a similar path is returned by the server (run only against systems you own).24.05.50 or 25.03.44, whichever matches your release line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/, /memberimages/, /screenshots/, /star-rating/images/, and /dashboards/images/screenshots/. This issue is fixed in versions 24.05.50 and 25.03.44.
This page as .md · .json · in your agent: get_signal("CVE-2026-41582")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.