Uncontrolled Directory Access in Countly's Product Analytics Solution

CVE-2026-42270

What is CVE-2026-42270?

The countly-server component of Countly is susceptible to a vulnerability that exposes its public image and screenshot routes to unauthenticated requests. These routes, specifically star-rating/images/, dashboards/images/screenshots/, appimages/, and memberimages/, can exploit a flaw in local filesystem storage. An attacker can craft a request with a URL-encoded dot to trigger the createReadStream function, causing it to read a directory instead of a file. This results in an unhandled EISDIR error during runtime, which leads to the termination of the Node.js process. This vulnerability can be exploited by making repeated requests, rendering the analytics API unavailable. The issue has been resolved in versions 24.05.50 and 25.03.44.

References