Countly countly-server: Stored XSS in feedback upload enables session compromise
Summary
countly-server, the server-side part of the Countly product analytics platform, contains a stored cross-site scripting flaw in the star-rating plugin's feedback upload. An authenticated application administrator can upload active content that is served with an attacker-influenced Content-Type. When a global administrator opens the preview, the payload runs in the Countly origin and can access authenticated session values such as auth_token and csrf_token. Exploitation requires a malicious application-admin account and a global administrator who opens the preview.
Affected
- countly-server before 24.05.50
- countly-server 25.03 line before 25.03.44
- Whether the star-rating plugin is enabled by default: Unknown.
Fixed in
- 24.05.50
- 25.03.44
Workaround
- No vendor workaround known.
- Until patched, limit application-admin accounts to trusted staff.
- Do not open feedback previews while logged in as a global administrator.
Exploitation
- CISA SSVC: exploitation status poc, automatable no, technical impact total.
- No public PoC confirmed by the sources reviewed; not listed in CISA KEV at the time of research.
- EPSS reported as low (about 0.004).
Our recommendation
- Identify all Countly instances and their versions.
- Update countly-server to 24.05.50 or 25.03.44 or later.
- Review and restrict application-admin rights.
- Limit access to the Countly admin panel to internal networks or VPN.
- Check whether personal data is processed and assess data-protection obligations if a compromise is suspected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-jqp4-p86c-phxc github.com
- Countly release 24.05.50 github.com
- Countly release 25.03.44 github.com
- Fix commit ae899f3 github.com
- Fix commit fcb16c8 github.com
- OSV entry CVE-2026-44977 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:06.
Original description (NVD)
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values. This issue is fixed in versions 24.05.50 and 25.03.44.
NVD references (6)
- https://github.com/Countly/countly-server/commit/ae899f37bc6d70c1b44859756ce80a204ae72631
- https://github.com/Countly/countly-server/commit/fcb16c808c0fdb6dc99fe9c66de7fc560b3a9c41
- https://github.com/Countly/countly-server/releases/tag/24.05.50
- https://github.com/Countly/countly-server/releases/tag/25.03.44
- https://github.com/Countly/countly-server/security/advisories/GHSA-jqp4-p86c-phxc
- https://github.com/Countly/countly-server/security/advisories/GHSA-jqp4-p86c-phxc
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.