CVE-2026-44977: countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including authtoken and csrftoken values. This issue is fixed in versions 24.05.50 and 25.03.44.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
countly-serverto a version that resolves this vulnerability.Fixed in 24.05.50 - Upgrade
Upgrade
countly-serverto a version that resolves this vulnerability.Fixed in 25.03.44
Event History
Frequently Asked Questions
Who can exploit this issue, and what user interaction is required?
A non-global application administrator can upload attacker-controlled active content through uploadFeedbackFile. Exploitation requires a global administrator to open the uploaded feedback preview.
What is the impact after a global administrator opens a malicious preview?
The payload executes in the Countly origin with the global administrator's authenticated session context. It can expose session capabilities including auth_token and csrf_token values, enabling compromise of that administrator's privileges.
Which deployments are affected and which versions fix the issue?
Countly Server versions before 24.05.50 and 25.03.44 are affected. Upgrade to 24.05.50 or 25.03.44, as applicable to the deployed release branch.
What should administrators do while an upgrade is not immediately possible?
Do not open feedback previews from untrusted or non-global application administrators. Treat files available under feedback/preview/ as potentially active content because the preview is served with an attacker-influenced Content-Type.