CVE-2026-41582

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41582
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41582.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41582
Aliases
  • GHSA-fqgp-6rm9-8696
Published
2026-10-16T16:03:39Z
Modified
2026-10-28T02:31:07Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files
Details

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/, /memberimages/, /screenshots/, /star-rating/images/, and /dashboards/images/screenshots/. This issue is fixed in versions 24.05.50 and 25.03.44.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41582.json"
}
References

Affected packages

Git / github.com/countly/countly-server

Affected ranges

Type
GIT
Repo
https://github.com/countly/countly-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e702a104d7616b1a96458da9fbf36144c5dd5ef4
Introduced
5890b94d9783feffa3d2acafba1d94d67b2ae4e6
Fixed
6050a3b1bcb0376701dbf68e346ac261363f5dfa
Fixed
405cb229ed37c744f6d61c42bf86fee5a7ee3530
Fixed
8004d29d3c789b70a79bf6e0380f0d546dbf42a9
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "24.05.50"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "25.03"
                },
                {
                    "fixed": "25.03.44"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "405cb229ed37c744f6d61c42bf86fee5a7ee3530"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "8004d29d3c789b70a79bf6e0380f0d546dbf42a9"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "24.05.50",
            "range": [
                {
                    "fixed": "e702a104d7616b1a96458da9fbf36144c5dd5ef4"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "25.03.44",
            "range": [
                {
                    "fixed": "6050a3b1bcb0376701dbf68e346ac261363f5dfa"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

16.*
16.02.1
16.06
22.*
22.03.6
22.09.10
22.09.11
22.09.12
22.09.13
22.09.14
22.09.15
22.09.16
22.09.17
22.09.18
22.09.19
22.09.8
22.09.9
22.09.test
23.*
23.03
23.03.1
23.03.2
23.03.3
23.03.4
23.03.5
23.03.6
23.03.7
23.03.8
23.03.9
23.06
23.06.1
23.06.10
23.06.11
23.06.12
23.06.13
23.06.14
23.06.15
23.06.16
23.06.2
23.06.3
23.06.4
23.06.5
23.06.6
23.06.7
23.06.8
23.06.9
23.11
23.11.1
23.11.10
23.11.11
23.11.12
23.11.13
23.11.14
23.11.15
23.11.16
23.11.17
23.11.18
23.11.19
23.11.2
23.11.20
23.11.21
23.11.22
23.11.3
23.11.4
23.11.5
23.11.6
23.11.7
23.11.8
23.11.9
23.11.test
23.7.11.hooks-vm
24.*
24.03.4
24.05
24.05.1
24.05.10
24.05.11
24.05.12
24.05.13
24.05.14
24.05.15
24.05.16
24.05.17
24.05.18
24.05.19
24.05.2
24.05.20
24.05.21
24.05.22
24.05.23
24.05.24
24.05.25
24.05.26
24.05.27
24.05.28
24.05.29
24.05.3
24.05.30
24.05.31
24.05.35
24.05.36
24.05.37
24.05.38
24.05.39
24.05.40
24.05.41
24.05.42
24.05.43
24.05.44
24.05.45
24.05.46
24.05.47
24.05.48
24.05.49
24.05.5
24.05.6
24.05.7
24.05.8
24.05.9
24.10.12
25.*
25.03.0
25.03.11
25.03.12
25.03.13
25.03.14
25.03.15
25.03.15.test
25.03.16
25.03.17
25.03.18
25.03.19
25.03.2
25.03.20
25.03.21
25.03.22
25.03.23
25.03.24
25.03.25
25.03.26
25.03.27
25.03.28
25.03.29
25.03.3
25.03.30
25.03.31
25.03.33
25.03.34
25.03.35
25.03.36
25.03.37
25.03.38
25.03.39
25.03.4
25.03.40
25.03.41
25.03.42
25.03.43
25.03.5
25.05.4
Other
SERVER-1658
countly-server-v13.*
countly-server-v13.06
v13.*
v13.10
v14.*
v14.08
v16.*
v16.12
v17.*
v17.05
v17.09
v18.*
v18.01
v18.01.1
v18.04
v18.04.1
v18.08
v19.*
v19.02
v20.*
v20.11
v20.11.1
v20.11.2
v21.*
v21.11
v21.11.1
v21.11.2
v21.11.3
v21.11.4
v22.*
v22.03
v22.03.1
v22.03.10
v22.03.11
v22.03.12
v22.03.2
v22.03.3
v22.03.4
v22.03.5
v22.03.6
v22.03.6.1
v22.03.6.2
v22.03.7
v22.03.8
v22.03.9
v22.06
v22.06.1
v22.06.2
v22.06.3
v22.06.4
v22.06.5
v22.08
v22.08.1
v22.08.2
v22.08.3
v22.08.4
v22.08.5
v22.08.6
v22.09
v22.09.1
v22.09.2
v22.09.3
v22.09.4
v22.09.5
v22.09.6
v22.09.7
v22.09.test
v22.09.test1
v22.09.test2
v22.09.test3
v24.*
v24.05.32
v24.05.33
v24.05.34
v25.*
v25.03.10
v25.03.32
v25.03.6
v25.03.7
v25.03.8
v25.03.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41582.json"