Countly vulnerabilities
We track 6 vulnerabilities in Countly products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 16, 2026.
Latest Countly vulnerabilities
- 9.0 Critical severity
countly-server: Improper Neutralization of Input During Web Page Generation
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content
- 7.5 High severity
countly-server: Uncaught Exception
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call ge
- 8.1 High severity
countly-server: Improper Limitation of a Pathname to a Restricted Directory
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without p
- 7.5 High severity
countly-server: Improper Limitation of a Pathname to a Restricted Directory
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app
- 7.1 High severity
countly-server: Incorrect Authorization
An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer
- 8.1 High severity
countly-server: Weak Password Recovery Mechanism for Forgotten Password
countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password re