Denial of Service in Countly Server via Directory Traversal

Executive Summary

CVE-2026-42270 is a Denial of Service (DoS) vulnerability in Countly server versions before 24.05.50 and 25.03.44. It affects public image and screenshot routes using local filesystem storage. Attackers can exploit unhandled stream exceptions by sending a URL-encoded dot to directory-based routes, causing Node.js to crash when attempting to read a directory as a file stream. This leads to repeated application process termination and keeps the analytics API offline.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in your Countly server process when accessing affected routes like /appimages/, /memberimages/, */screenshots/, /star-rating/images/, or /dashboards/images/screenshots/. Check logs for EISDIR errors or unhandled exceptions during stream operations. Use curl to test endpoints with URL-encoded dots, e.g., curl -v 'http://your-server/star-rating/images/%252e' to see if it triggers crashes.

Check server logs for repeated Node.js process terminations or unhandled stream errors. Verify if your Countly version is below 24.05.50 or 25.03.44, as these versions are vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause your Countly analytics API to become unavailable, preventing client SDKs from uploading telemetry data. Repeated exploitation may lead to severe data loss as analytics data cannot be collected. The entire application process may crash, disrupting analytics services and potentially affecting user experience.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing prolonged unavailability of the analytics API, potentially leading to interruptions in data processing and reporting. GDPR requires timely data breach notifications and uninterrupted processing for critical services, while HIPAA mandates continuous availability of health data systems. The DoS condition may result in unauthorized data access risks or service disruptions, violating availability requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Countly server to version 24.05.50 or 25.03.44 or later to patch the vulnerability. If upgrading is not possible, apply the stream error handling patches from commits 72f19bc or f9ad314 to add error listeners to read streams in affected routes.

Temporarily restrict access to vulnerable endpoints by implementing network-level controls or WAF rules to block requests containing URL-encoded dots or path traversal patterns. Monitor server stability closely after applying mitigations.

Useful 0 Not Useful 0