CVE-2026-44977
Received Received - Intake

Stored XSS in Countly Server via Feedback File Upload

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values. This issue is fixed in versions 24.05.50 and 25.03.44.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-44977
EUVD
EUVD-2026-102918

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Countly countly-server < 24.05.50
Countly countly-server >= 25.03, < 25.03.44

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Countly Server. An application-level administrator with write access to a single application can upload malicious HTML or JavaScript files disguised as images via the feedback upload feature. The server stores these files and serves them from a public preview endpoint. When a higher-privileged user, like a global administrator, accesses the malicious preview URL, the payload executes in their browser, allowing the attacker to steal sensitive authentication tokens such as auth_token and csrf_token.

Detection Guidance

Check Countly server versions for affected releases (24.05.x before 24.05.50 or 25.03.x before 25.03.44). Inspect feedback upload endpoints (/i/feedback/upload) for unexpected file uploads with executable content. Review server logs for requests to /feedback/preview/* paths with unusual parameters or file types.

Impact Analysis

If you are a global administrator in Countly Server, an attacker could exploit this vulnerability to execute malicious code in your browser session. This could lead to theft of your authentication tokens, session hijacking, or unauthorized actions performed on your behalf. The attacker could gain full control over your Countly account and access sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance requirements. If authentication tokens or other sensitive data are stolen, it may result in data breaches, unauthorized processing of personal data, or exposure of protected health information, leading to legal and regulatory penalties.

Mitigation Strategies

Upgrade Countly server to patched versions (24.05.50 or 25.03.44). Disable feedback upload functionality if unused. Implement strict file upload validation to allow only image formats (PNG, JPEG, GIF, WebP). Add security headers like X-Content-Type-Options: nosniff and CSP with sandbox directive.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44977. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart