What’s Vulnerable › Products

countly-server vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your countly-server version is affected

Latest countly-server vulnerabilities

• CVE-2026-44977 — countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context (CVSS 9.0)
• CVE-2026-42270 — countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception (CVSS 7.5)
• CVE-2026-42269 — countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion (CVSS 8.1)
• CVE-2026-41582 — countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files (CVSS 7.5)
• CVE-2026-87803 — (CVSS 7.1)
• CVE-2021-32852 — countly-server vulnerable to Cross-site Scripting (CVSS 9.0)
• CVE-2022-29174 — Predictable password reset token may lead to account takeover in countly-server (CVSS 8.1)