---
id: "CVE-2026-42269"
kind: "vulnerability"
aliases: ["CVE-2026-42269"]
title: "Countly server: authenticated migration delete path lets users remove arbitrary files"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["analytics", "countly", "node.js", "package", "self-hosted"]
not_affected_if: ["auth-required", "default-config", "managed-hosting"]
published_at: "2026-10-16T16:17:23+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:06:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42269", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Countly server: authenticated migration delete path lets users remove arbitrary files

Countly's data-migration deletion route passes a user-supplied export ID into a recursive delete without path validation. An authenticated administrator or user with migration permission can delete writable files or directory trees on the server, causing data loss or service disruption.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed countly-server version in its package.json or install directory; versions before `24.05.50` and `25.03.44` are affected
- Confirm whether the data_migration plugin is present under `plugins/data_migration`

## Fix

- Upgrade countly-server to `24.05.50` or `25.03.44` (or later in the same branch)
- Restrict migration permissions to trusted administrators until upgraded

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-42269

## From the sources

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees and cause data loss or service disruption. This issue is fixed in versions 24.05.50 and 25.03.44.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_