Server-side Vulnerability in Countly Product Analytics Solution
CVE-2026-44977

9CRITICAL

Key Information:

Vendor

Countly

Status
Countly-server
Vendor
CVE Published:
16 October 2026

What is CVE-2026-44977?

The Countly server, which is integral to the Countly product analytics solution, contains a vulnerability that enables non-global application administrators to upload malicious content by exploiting the uploadFeedbackFile function in the star-rating plugin prior to versions 24.05.50 and 25.03.44. This risk arises from improper handling of MIME types, allowing attackers to serve their content publicly. When a global administrator accesses this content through the feedback preview, the payload is executed within the Countly environment, potentially revealing sensitive session information like auth_token and csrf_token. The issue has been rectified in the aforementioned versions.

Affected Version(s)

countly-server < 24.05.50 < 24.05.50

countly-server >= 25.03, < 25.03.44 < 25.03, 25.03.44

References

https://github.com/Countly/countly-server/security/adviso...
x_refsource_CONFIRM
https://github.com/Countly/countly-server/commit/ae899f37...
x_refsource_MISC
https://github.com/Countly/countly-server/commit/fcb16c80...
x_refsource_MISC

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.