Is CVE-2026-44977 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44977 being exploited in the wild.

How severe is CVE-2026-44977?

Critical severity, with a CVSS score of 9, published 16 October 2026.

Which products and versions are affected?

Countly-Server before 24.05.50 and 25.03.44.

Is there a fix for CVE-2026-44977?

Yes: fixed in 24.05.50, 25.03.44. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44977 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-44977?

Check whether you run Countly-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44977: Countly countly-server stored XSS in star-rating feedback upload

CVE-2026-44977 · Severity: critical · CVSS 9 · Published 2026-10-16

Countly is a product analytics platform that collects and analyzes user behavior data. An app administrator can upload arbitrary JavaScript files disguised as images to the star-rating feedback system, which are then executed in a global administrator's browser when they preview the feedback, allowing the attacker to steal authentication and session tokens that grant access to the entire analytics dashboard.

Technologies: Countly-Server. Vendors: Countly.

Quick answers

Is CVE-2026-44977 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44977 being exploited in the wild.
How severe is CVE-2026-44977?: Critical severity, with a CVSS score of 9, published 16 October 2026.
Which products and versions are affected?: Countly-Server before 24.05.50 and 25.03.44.
Is there a fix for CVE-2026-44977?: Yes: fixed in 24.05.50, 25.03.44. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44977 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-44977?: Check whether you run Countly-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 24.05.50, 25.03.44

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the star-rating plugin's feedback upload/preview endpoints. A non-global app admin can upload malicious HTML or JavaScript files to the /i/feedback/upload endpoint while setting an arbitrary MIME type, which is stored and later reflected as the Content-Type header during preview. When a global administrator accesses /feedback/preview/ to view the feedback, the payload executes in the dashboard origin, allowing same-origin XHR requests to exfiltrate countlyGlobal auth_token and csrf_token values. The fix includes server-side magic byte validation, content-type re-derivation at preview time, sandbox CSP headers, and stricter authorization checks.

Affected products

Countly countly-server before 24.05.50 and 25.03.44

Timeline

2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.