CVE-2026-41582

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.

• CWE-22

• https://github.com/Countly/countly-server/commit/405cb229ed37c744f6d61c42bf86fee5a7ee3530
• https://github.com/Countly/countly-server/commit/8004d29d3c789b70a79bf6e0380f0d546dbf42a9
• https://github.com/Countly/countly-server/releases/tag/24.05.50
• https://github.com/Countly/countly-server/releases/tag/25.03.44
• https://github.com/Countly/countly-server/security/advisories/GHSA-fqgp-6rm9-8696
• https://github.com/Countly/countly-server/security/advisories/GHSA-fqgp-6rm9-8696

Published

Oct 16, 2026

Last Modified

Oct 19, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41576Brave CMS is an open-source CMS. Prior to commit 6c56603, th…7.1
• CVE-2026-41577authentik is an open-source identity provider. Prior to vers…7.5
• CVE-2026-41579runc is a CLI tool for spawning and running containers accor…3.3
• CVE-2026-4158KeePassXC OpenSSL Configuration Uncontrolled Search Path Ele…7.3
• CVE-2026-41580Stirling-PDF is a locally hosted web application that facili…6.1
• CVE-2026-41581Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-41583ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…9.1
• CVE-2026-41584ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…7.5
• CVE-2026-41585ZEBRA is a Zcash node written entirely in Rust. From zebrad …6.5
• CVE-2026-41586Hyperledger Fabric is an enterprise-grade permissioned distr…9.8
• CVE-2026-41587CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …8.6
• CVE-2026-41588RELATE is a web-based courseware package. Prior to commit 2f…8.1