CVE-2026-42269

8.1High

Published 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on integrity, availability
Weakness: CWE-22

Impact

Authenticated users with migration permissions or admins can delete arbitrary writable files and directories on the server. This allows them to destroy application data or take down the service.

Root cause

The data migration deletion endpoint concatenates the user-supplied exportid into a file path without sanitization, triggering a path traversal that recursively removes files outside the import directory.

Affected systems

Countly server versions prior to 24.05.50 and 25.03.44

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Fix & remediation

Upgrade countly-server to 24.05.50, 25.03.44, or later. If upgrading immediately is not possible, disable the data_migration plugin or revoke migration permissions from non-essential users.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees and cause data loss or service disruption. This issue is fixed in versions 24.05.50 and 25.03.44.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-42269