CVE-2026-41582: countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/, /memberimages/, /screenshots/, /star-rating/images/, and /dashboards/images/screenshots/. This issue is fixed in versions 24.05.50 and 25.03.44.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
countly-serverto a version that resolves this vulnerability.Fixed in 24.05.50 - Upgrade
Upgrade
countly-serverto a version that resolves this vulnerability.Fixed in 25.03.44
Event History
Frequently Asked Questions
Which deployments are exposed to arbitrary file disclosure?
Deployments using the local filesystem backend are affected. The vulnerable public routes can reach filesystem operations that disclose files readable by the Countly server process.
Does exploitation require authentication or user interaction?
No. The vulnerable image and screenshot routes are public, and the issue can be exploited by an unauthenticated remote requester without user interaction.
Which routes should be reviewed for exploitation attempts?
Review requests to /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*, particularly paths containing traversal sequences intended to escape asset directories.
What versions contain the fix?
The issue is fixed in Countly Server versions 24.05.50 and 25.03.44. Versions prior to those releases are affected when using the local filesystem backend.