CVE-2026-42269 Countly CVE debrief

Who should care

Defenders responsible for countly-server installations should assess exposure and prioritize patching or mitigating this vulnerability. This includes reviewing the current version of countly-server, verifying the presence of migration permissions, and understanding the potential impact of arbitrary file and directory deletion on their systems. Additionally, security teams and vulnerability management teams should be aware of the potential risks and plan to

Why it matters

CVE-2026-42269 is a high-severity vulnerability in countly-server that allows an authenticated user to delete arbitrary files and directories, leading to potential data loss or service disruption. Defenders responsible for countly-server installations should assess exposure and prioritize patching or mitigating this vulnerability.

• Potential data loss due to arbitrary file and directory deletion
• Possible service disruption due to deletion of critical files
• Need for verification of affected versions and remediation

Technical summary

The vulnerability is caused by a path traversal issue in the delete_import endpoint of countly-server, a product analytics solution. This allows an authenticated user with migration permission to delete arbitrary files and directories, leading to potential data loss or service disruption. The issue arises from the lack of path validation when the user-controlled exportid is passed to clean_up_data. The affected code is located in plugins/data_migration/api/api.js and plugins/data_migration/api/data_migration_helper.js, where the exportid is concatenated into a path and removed recursively without proper validation.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability to prevent potential data loss or service disruption.

Recommended defensive actions

• Patch countly-server to version 24.05.50 or 25.03.44
• Restrict access to the delete_import endpoint
• Monitor for suspicious activity on the countly-server
• Verify affected countly-server deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by a path traversal issue in the delete_import endpoint, which allows an authenticated user to delete arbitrary files and directories. The issue is fixed in versions 24.05.50 and 25.03.44.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.