Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-41582— countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files

Quick assessment

Affected
Countly countly-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Countly-server 是 Countly（一款产品分析解决方案）的服务器端组件。在版本 24.05.50 和 25.03.44 之前，位于 、 以及 中的公开图片和截图路由，在拼接由攻击者控制的通配符路径时，未实施包含性验证（containment validation）。在采用本地文件系统作为后端存储的部署环境中，未经身份验证的请求可突破预设的资源目录限制，访问 中的 或 函数，从而导致任意可读的服务器文件被泄露。受影响的路径包括： 、 、 、 以及 。该问题已在版本 24.05.50 和 25.03.4

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-41582

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files
Source: CVE Program / CVE List V5
Vulnerability Description
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Countly countly-server < 24.05.50 -

II. Public POCs for CVE-2026-41582

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-41582

请登录查看更多情报信息。

Other References for CVE-2026-41582 (5)

Same Patch Batch · Countly · 2026-10-16 · 4 CVEs total

CVE-2026-44977 9.0 CRITICAL countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin
CVE-2026-42269 8.1 HIGH countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directo
CVE-2026-42270 7.5 HIGH countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception

IV. Related Vulnerabilities

Same product: countly-server
Same vendor: Countly
Same weakness: CWE-22

V. Comments for CVE-2026-41582

No comments yet

Leave a comment