Is CVE-2026-41582 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41582 being exploited in the wild.

How severe is CVE-2026-41582?

High severity, with a CVSS score of 7.5, published 16 October 2026.

Which products and versions are affected?

Countly-Server before 24.05.50 and before 25.03.44.

Is there a fix for CVE-2026-41582?

Yes: fixed in 24.05.50, 25.03.44. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41582 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-41582?

Check whether you run Countly-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41582: Countly countly-server path traversal in image routes

CVE-2026-41582 · Severity: high · CVSS 7.5 · Published 2026-10-16

Countly Server is a product analytics platform that stores user data and application metrics. An unauthenticated attacker can exploit path traversal vulnerabilities in the image serving routes to read arbitrary files from the server filesystem, potentially exposing sensitive configuration files, private keys, or other confidential data without authentication.

Technologies: Countly-Server. Vendors: Countly.

Quick answers

Is CVE-2026-41582 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41582 being exploited in the wild.
How severe is CVE-2026-41582?: High severity, with a CVSS score of 7.5, published 16 October 2026.
Which products and versions are affected?: Countly-Server before 24.05.50 and before 25.03.44.
Is there a fix for CVE-2026-41582?: Yes: fixed in 24.05.50, 25.03.44. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41582 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-41582?: Check whether you run Countly-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 24.05.50, 25.03.44

Technical details

Multiple image and screenshot routes in countly-server (including /appimages/*, /memberimages/*, /star-rating/images/*, and /dashboards/images/screenshots/*) fail to validate or sanitize wildcard path components, allowing directory traversal via sequences like ../ to reach the filesystem. When deployments use the local filesystem backend, attackers can traverse to arbitrary readable server files through the getStats and getStream functions in api/utils/countlyFs.js. This requires no authentication and can be exploited remotely.

Affected products

Countly countly-server before 24.05.50 and before 25.03.44

Timeline

2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.