Key points
- The flaw affects Countly Server versions prior to 24.05.50 and 25.03.44.
- Authenticated users with migration permissions can delete files outside intended directories.
- Updates to versions 24.05.50 and 25.03.44 resolve the path traversal issue.
Countly Server versions earlier than 24.05.50 and 25.03.44 contain a high-severity vulnerability that allows file deletion. The flaw is tracked as CVE-2026-42269. Administrators and users with specific migration permissions can exploit this issue to remove writable files or entire directory trees. This capability exists within the server-side component of the product analytics solution. The vendor has released patches for both affected version branches.
In plain English
The problem occurs in the data migration feature of Countly Server. When a user initiates a cleanup task, the system uses an identifier provided by the user to locate files. The code fails to validate this identifier properly. It allows the system to look outside the intended import directory. An attacker can craft a request that points to sensitive locations. The system then deletes those files recursively. This can lead to significant data loss or service disruption.
The background
This issue stems from insufficient path validation in the `clean_up_data` function. The `data_migration_helper.js` file concatenates user input directly into file paths. This design flaw enables path traversal attacks. It is similar to other directory traversal issues reported recently. For instance, Patch Review noted a high-severity flaw in HPE NonStop Python allowing file overwrites via crafted archives. Another report highlighted unauthenticated remote code execution in IBM Guardium via path traversal.
Who needs to act first
Teams should prioritize updating systems exposed to internal networks where administrators operate. Since the flaw requires authentication, focus on environments with active migration workflows. Test the update in a staging environment first to ensure compatibility. Back up configuration files and databases before applying changes. If immediate patching is not possible, restrict migration permissions to essential personnel only. Monitor logs for unusual deletion activities during the interim period.
Background: Path traversal vulnerabilities
Prevent path traversal by enforcing strict allowlists for permitted file names, using chroots to isolate processes, and canonicalizing paths to resolve symbolic links. Avoid relying solely on input filtering, as attackers can encode slashes or use null bytes to bypass basic checks.
Read the full guide: Stop Path Traversal Attacks: Defense Strategies That Actually Work
What to do and how to stay safe: Countly
- Verify your Countly Server version against the vulnerable ranges listed in the advisory.
- Apply the available updates to versions 24.05.50 or 25.03.44 as soon as possible.
- Review access controls for the data migration feature to limit user permissions.
- Monitor system logs for unexpected file deletions or permission errors after patching.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Countly Server are affected by CVE-2026-42269?
Versions prior to 24.05.50 and versions from 25.03 up to 25.03.44 are affected.
What permissions are required to exploit this vulnerability?
An application administrator or a user with migration permission can exploit the flaw.
Is there a fix available for this issue?
Yes, the issue is fixed in versions 24.05.50 and 25.03.44.
