High severity · published Oct 16, 2026
CVE-2026-42269
countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion
8.1
CVSS
0.5%
EPSS
No
On KEV
Description
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees and cause data loss or service disruption. This issue is fixed in versions 24.05.50 and 25.03.44.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
countly-server · Countly
< 24.05.50; >= 25.03, < 25.03.44 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42269
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42269
github.com
https://github.com/Countly/countly-server/blob/master/CHANGELOG.md#version-250344
github.com
https://github.com/Countly/countly-server/commit/764e2a1d86f9af600113f77422d520338c214229
github.com
https://github.com/Countly/countly-server/commit/b652ee8dafa91602705004d0edb602a91a0d845e
github.com
https://github.com/Countly/countly-server/releases/tag/24.05.50
github.com
https://github.com/Countly/countly-server/releases/tag/25.03.44
github.com
https://github.com/Countly/countly-server/security/advisories/GHSA-5pmc-54j6-jcgq
More from countly-server
9.0
CVE-2026-44977
countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context
9.0
CVE-2021-32852
countly-server vulnerable to Cross-site Scripting
8.1
CVE-2022-29174
Predictable password reset token may lead to account takeover in countly-server
7.5
CVE-2026-41582
countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files
7.5
CVE-2026-42270
countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception