{"id":"CVE-2026-42269","kind":"vulnerability","aliases":["CVE-2026-42269"],"related":[],"title":"Countly server: authenticated migration delete path lets users remove arbitrary files","description":"countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees and cause data loss or service disruption. This issue is fixed in versions 24.05.50 and 25.03.44.","summary":"Countly's data-migration deletion route passes a user-supplied export ID into a recursive delete without path validation. An authenticated administrator or user with migration permission can delete writable files or directory trees on the server, causing data loss or service disruption.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["analytics","countly","node.js","package","self-hosted"],"not_affected_if":["auth-required","default-config","managed-hosting"],"how_to_check":"- Check the installed countly-server version in its package.json or install directory; versions before `24.05.50` and `25.03.44` are affected\n- Confirm whether the data_migration plugin is present under `plugins/data_migration`","fix":"- Upgrade countly-server to `24.05.50` or `25.03.44` (or later in the same branch)\n- Restrict migration permissions to trusted administrators until upgraded","status":"open","published_at":"2026-10-16T16:17:23+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:06:42+00:00","updated_at":"2026-10-25T03:06:42+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:06:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade countly-server to `24.05.50` or `25.03.44` (or later in the same branch)\n- Restrict migration permissions to trusted administrators until upgraded","reach":"network","title":"Countly server: authenticated migration delete path lets users remove arbitrary files","impact":"medium","summary":"Countly's data-migration deletion route passes a user-supplied export ID into a recursive delete without path validation. An authenticated administrator or user with migration permission can delete writable files or directory trees on the server, causing data loss or service disruption.","category":"package","nicknames":[],"who_cares":["countly","self-hosted","node.js","analytics"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker deletes server files and directory trees, causing data loss or outage","analyst_note":"","how_to_check":"- Check the installed countly-server version in its package.json or install directory; versions before `24.05.50` and `25.03.44` are affected\n- Confirm whether the data_migration plugin is present under `plugins/data_migration`","needs_analyst":false,"not_affected_if":["managed-hosting","auth-required","default-config"],"who_is_affected":"Self-hosted Countly servers running a version before 24.05.50 or 25.03.44 where the data_migration plugin is present and users hold application administrator or migration permission. Attackers need an authenticated account with those rights, so instances limited to trusted admins carry less risk. Managed Countly hosting is handled by the vendor.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000616,"input_tokens":3408,"output_tokens":551,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-42269':14A,17A '24.05.50':87C,158C '25.03.44':89C,160C 'administr':48B,132C 'allow':129C 'analyt':18B,83C 'applic':131C 'arbitrari':10A 'authent':3A,47B,91C 'call':126C 'caus':64B,146C 'clean':106C 'concaten':113C 'control':103C 'count':1A,19B,25B,71C,80C 'countly-serv':70C 'cve':12A,15A 'data':28B,65B,93C,108C,147C 'data-migr':27B,92C 'delet':5A,30B,42B,55B,95C,139C 'directori':59B,124C,143C 'disrupt':69B,151C 'export':37B 'exportid':104C 'file':11A,57B,141C 'fix':155C 'host':24B 'id':38B 'identifi':115C 'import':123C 'intend':122C 'issu':153C 'let':7A 'loss':66B,148C 'migrat':4A,29B,52B,94C,136C 'node.js':20B 'outsid':120C 'packag':21B 'part':78C 'pass':32B,99C 'path':6A,44B,110C,118C 'permiss':53B,137C 'plugins/data_migration/api/api.js':98C 'plugins/data_migration/api/data_migration_helper.js':112C 'prior':85C 'product':82C 'recurs':41B,128C 'remov':9A,127C 'resolv':119C 'rout':31B,96C 'self':23B 'self-host':22B 'server':2A,63B,72C,76C 'server-sid':75C 'servic':68B,150C 'side':77C 'solut':84C 'suppli':36B 'tree':60B,144C 'user':8A,35B,50B,102C,134C 'user-control':101C 'user-suppli':34B 'valid':45B,111C 'version':157C 'without':43B,109C 'writabl':56B,140C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Countly servers running a version before 24.05.50 or 25.03.44 where the data_migration plugin is present and users hold application administrator or migration permission. Attackers need an authenticated account with those rights, so instances limited to trusted admins carry less risk. Managed Countly hosting is handled by the vendor.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T16:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-42269","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42269","severity":null,"published_at":"2026-10-16T16:17:23+00:00","modified_at":"2026-10-16T20:02:37+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}