Path Traversal Vulnerability in Countly Product Analytics Solution
CVE-2026-42269
8.1HIGH
What is CVE-2026-42269?
Countly's server-side component contains a vulnerability that allows an attacker with migration permissions to exploit an insecure deletion route. Through improper validation of user-controlled input, an authenticated user can potentially construct paths that escape the intended directory. This enables unauthorized deletion of files or entire directory trees, posing a significant risk of data loss and service disruption. The vulnerability was resolved in versions 24.05.50 and 25.03.44, with users advised to upgrade to mitigate risks.
Affected Version(s)
countly-server < 24.05.50 < 24.05.50
countly-server >= 25.03, < 25.03.44 < 25.03, 25.03.44