CVE-2026-42269: countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/datamigration/api/api.js passes the user-controlled exportid to cleanupdata without path validation. plugins/datamigration/api/datamigrationhelper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees and cause data loss or service disruption. This issue is fixed in versions 24.05.50 and 25.03.44.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
countly-serverto a version that resolves this vulnerability.Fixed in 24.05.50 - Upgrade
Upgrade
countly-serverto a version that resolves this vulnerability.Fixed in 25.03.44
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated application administrator or a user granted migration permission can exploit it. No user interaction is required.
Which deployments are affected?
Countly Server versions earlier than 24.05.50 and 25.03.44 are affected if an attacker has an account with application administrator or migration permissions. The vulnerable route is part of the data-migration plugin.
What can an attacker delete?
By supplying a path-traversal value as the export identifier, an authorized attacker can cause recursive deletion of writable files or directory trees outside the intended import directory. This can result in data loss or service disruption.
What should be done if an immediate upgrade is not possible?
Restrict application administrator and migration permissions to trusted users, since those permissions are required for exploitation. Review writable files and directories accessible to the Countly Server process and maintain backups to reduce the impact of deletion.
How can defenders determine whether they are exposed?
Check the Countly Server version and whether the data-migration plugin is present. Versions prior to 24.05.50 or 25.03.44 with users holding application administrator or migration permissions should be treated as exposed.