CVE-2026-42269
Received Received - Intake

Path Traversal in Countly Server

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees and cause data loss or service disruption. This issue is fixed in versions 24.05.50 and 25.03.44.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-42269
EUVD
EUVD-2026-102915

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Countly countly-server < 24.05.50
Countly countly-server >= 25.03, < 25.03.44

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Path Traversal issue in the Countly server's data migration plugin. It allows authenticated users with admin or migration permissions to delete arbitrary files on the server by exploiting insufficient input validation. The flaw occurs because the application does not sanitize the exportid parameter before using it to construct file system paths, enabling attackers to navigate outside the intended directory and delete critical files or entire directory trees recursively.

Detection Guidance

To detect this vulnerability, monitor for unauthorized file deletions or suspicious path traversal attempts in Countly server logs. Check for HTTP requests containing directory traversal sequences like ../../ in the exportid parameter. Review file system changes in directories outside the intended import/export folders.

Impact Analysis

An attacker could exploit this to delete important system files, application data, or directories, leading to service disruption or permanent data loss. The vulnerability allows recursive deletion, meaning entire directory trees could be wiped out. This could crash the Countly server or cause other dependent services to fail.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized data deletion or corruption. GDPR requires data integrity and protection, while HIPAA mandates safeguards for protected health information. A successful exploit could result in data breaches, unauthorized access, or loss of critical records, violating these regulations.

Mitigation Strategies

Immediately upgrade Countly server to version 24.05.50 or 25.03.44 or later. If upgrading is not possible, restrict migration permissions to trusted users only. Implement strict input validation for the exportid parameter to block path traversal sequences. Audit file system permissions to limit write access to critical directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42269. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart