CVE-2026-42269: Countly Server Path Traversal Risks Data Loss Before 24.05.50

An authenticated data-migration route in Countly server software allows attackers to delete files outside the intended directory structure. The vulnerability, tracked as CVE-2026-42269, has a CVSS score of 8.1, which classifies it as high severity. It affects environments running server versions prior to 24.05.50 and those running version 25.03 up to 25.03.43. Users with migration permissions or administrative access can trigger the exploit.

What is the technical cause?

The issue stems from how the server handles user-controlled input during data migration cleanup. According to the NVD record, the `clean_up_data` function in `plugins/data_migration/api/api.js` passes an `exportid` parameter without validating the file path. This identifier is then concatenated into a path in `plugins/data_migration/api/data_migration_helper.js`. The system resolves this path outside the intended import directory.

How does the exploit work?

Once the path is resolved, the system calls a recursive remove operation on the target. This allows the authenticated user to delete writable files or entire directory trees. The source material notes that this capability can lead to significant data loss or cause service disruption for the analytics platform. The flaw is categorized under CWE-22, indicating an improper limitation of a pathname to a restricted directory.

Which versions are vulnerable?

Organizations using Countly server must check their specific version numbers against the affected ranges. Versions older than 24.05.50 are vulnerable. Additionally, any version in the 25.03 line that is older than 25.03.44 is exposed to this risk. The vendor has released fixes for both affected lines. The secure versions are 24.05.50 and 25.03.44.

How does this compare to recent flaws?

This incident involves authenticated abuse of a specific functional route, unlike the unauthenticated path traversal in Risesoft-y9 that Firewall Scoop reported on 2026-10-13. It also differs from the openapi-typescript-codegen flaw reported on 2026-10-11, which allowed arbitrary JavaScript execution. The Countly issue requires existing permissions to trigger destructive file operations, rather than remote code execution via input injection.

Detection notes

Security teams should monitor for unusual file deletion activity originating from service accounts with migration privileges. Check system logs for recursive remove commands triggered by the data migration API. Look for sudden gaps in file integrity or missing configuration files in non-standard directories. Review access logs for the specific API endpoint associated with migration cleanup. If suspicious deletions occur, isolate the affected server immediately. Disable the migration feature if possible until the patch is applied. Verify the integrity of critical application directories.

What to do and how to stay safe: Countly

• Verify your Countly server version and update to 24.05.50 or 25.03.44 if you are running an affected release.
• Review access logs for the data migration API to identify any unauthorized deletion attempts.
• Restrict migration permissions to only essential administrators until the patch is confirmed effective.
• Monitor file system integrity for unexpected deletions in directories outside the import folder.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-42269?

The CVSS score is 8.1, which is classified as high severity.

Do I need authentication to exploit this flaw?

Yes, an attacker needs to be an application administrator or have migration permissions.

Is there a fix available?

Yes, the issue is fixed in versions 24.05.50 and 25.03.44.