Countly Server Flaw Allows Admins to Delete Files, Fix Available
A high-severity path traversal flaw in Countly server versions before 24.05.50 and 25.03.44 lets authenticated users delete files.
Key points
- CVE-2026-42269 has a CVSS score of 8.1, rated as high severity.
- The flaw affects Countly server versions prior to 24.05.50 and 25.03.44.
- Patches are available in versions 24.05.50 and 25.03.44.
Countly server administrators must update to version 24.05.50 or 25.03.44 to stop authenticated users from deleting critical system files. The vulnerability, identified as CVE-2026-42269, carries a CVSS score of 8.1, which is classified as high severity. This issue impacts the data-migration deletion route within the server-side component of the product analytics solution.
How it unfolded
- The flaw exists in the authenticated data-migration deletion route located in plugins/data_migration/api/api.js.
- User-controlled exportid parameters are passed to clean_up_data without any path validation checks.
- The helper script concatenates this identifier into a path resolved outside the intended import directory.
Who is affected
Organisations running Countly server versions earlier than 24.05.50 are vulnerable. Additionally, any installation running version 25.03 or later but earlier than 25.03.44 is also at risk. The weakness allows an application administrator or any user with migration permissions to delete writable files or entire directory trees. This can lead to significant data loss or service disruption for the analytics platform.
Our take on the response
The vendor has released patches for both affected version branches. Users on the 24.05 line should move to 24.05.50, while those on the 25.03 line must upgrade to 25.03.44. This follows a pattern seen in other recent analytics tool vulnerabilities, such as the QNAP QuMagie patch released in October 2026. Prompt updates are essential to prevent authenticated abuse of the migration feature.
Who needs to act first
Teams usually prioritise systems exposed to internal networks where privileged users operate. Check whether your environment uses the data-migration feature frequently. Back up configuration files and databases before applying the update. Test the patch in a staging environment to ensure no disruption to analytics collection. Roll out the fix to production servers immediately after validation. Monitor logs for any unusual deletion activity during the transition.
What to do and how to stay safe
- Verify your Countly server version and compare it against the affected ranges.
- Apply the update to version 24.05.50 or 25.03.44 as soon as possible.
- Restrict migration permissions to only those who absolutely need them.
- Monitor system logs for unexpected file deletions or directory removals.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-42269?
The CVSS score is 8.1, which is rated as high severity.
