cyfenced.com →

[ CVE-2026-44977 · Published 16 Oct 2026 ]

Vulnerability in countly-server

CVSS 9.0 EPSS <1%No fix listed yet

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)
  • Critical severity: CVSS 9.0

[ Description ]Official description

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values. This issue is fixed in versions 24.05.50 and 25.03.44.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References