countly-server vulnerabilities
CVEs whose affected-version data names the countly-server package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-42269High· 8.1countly-server is the server-side part of Countly, a product analytics solution
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to …
CVE-2026-42270High· 7.5PoCcountly-server is the server-side part of Countly, a product analytics solution
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs stora…
CVE-2026-44977Critical· 9.0PoCcountly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-con…
CVE-2026-41582High· 7.5PoCcountly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/…
CVE-2026-87803High· 7.1An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer
An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it thr…