Countly countly-server: Path traversal in data migration deletion route
Summary
The data migration plugin of countly-server, the server component of the Countly product analytics platform, does not validate the export ID used in its authenticated deletion route. An attacker with application administrator rights or the migration permission can use crafted IDs to delete files and directory trees outside the intended import directory. This can cause data loss or service disruption.
Affected
- countly-server versions before 24.05.50
- countly-server 25.03 line before 25.03.44
Fixed in
- Upgrade to 24.05.50 or 25.03.44 (or later)
Workaround
Unknown.
Exploitation
- Exploitation in the wild: Unknown.
- Public proof of concept: not confirmed; one secondary source reports none.
- EPSS: 0.00469 (low).
- CISA SSVC: Exploitation none, not automatable, partial technical impact.
Our recommendation
- Update countly-server to 24.05.50 or 25.03.44 (or later) in the next maintenance window, sooner if the dashboard is internet-facing.
- Limit the application administrator and migration permissions to named trusted staff.
- Disable the data_migration plugin if it is not used.
- Verify that backups of the Countly data and file system are current and restorable.
- Check the GitHub security advisory GHSA-5pmc-54j6-jcgq for vendor guidance.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-5pmc-54j6-jcgq github.com
- Countly 24.05.50 release github.com
- Countly 25.03.44 release github.com
- Fix commit b652ee8d github.com
- Fix commit 764e2a1d github.com
- VulDB entry 421336 vuldb.com
- Strix CVE summary www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:52.
Original description (NVD)
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees and cause data loss or service disruption. This issue is fixed in versions 24.05.50 and 25.03.44.
NVD references (6)
- https://github.com/Countly/countly-server/blob/master/CHANGELOG.md#version-250344
- https://github.com/Countly/countly-server/commit/764e2a1d86f9af600113f77422d520338c214229
- https://github.com/Countly/countly-server/commit/b652ee8dafa91602705004d0edb602a91a0d845e
- https://github.com/Countly/countly-server/releases/tag/24.05.50
- https://github.com/Countly/countly-server/releases/tag/25.03.44
- https://github.com/Countly/countly-server/security/advisories/GHSA-5pmc-54j6-jcgq
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.