# CVE-2026-44977: Countly countly-server stored XSS in star-rating feedback upload

Source: https://junglewise.ai/threats/cve-2026-44977-countly-server-is-the-server-side-part-of-countly-a-product  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-44977 · Severity: critical · CVSS 9 · Published 2026-10-16

Countly is a product analytics platform that collects and analyzes user behavior data. An app administrator can upload arbitrary JavaScript files disguised as images to the star-rating feedback system, which are then executed in a global administrator's browser when they preview the feedback, allowing the attacker to steal authentication and session tokens that grant access to the entire analytics dashboard.

Technologies: [Countly-Server](https://junglewise.ai/threats/technologies/countly-server). Vendors: [Countly](https://junglewise.ai/threats/vendors/countly).

## Quick answers

**Is CVE-2026-44977 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44977 being exploited in the wild.

**How severe is CVE-2026-44977?** Critical severity, with a CVSS score of 9, published 16 October 2026.

**Which products and versions are affected?** Countly-Server before 24.05.50 and 25.03.44.

**Is there a fix for CVE-2026-44977?** Yes: fixed in 24.05.50, 25.03.44. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44977 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-44977?** Check whether you run Countly-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 24.05.50, 25.03.44

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the star-rating plugin's feedback upload/preview endpoints. A non-global app admin can upload malicious HTML or JavaScript files to the /i/feedback/upload endpoint while setting an arbitrary MIME type, which is stored and later reflected as the Content-Type header during preview. When a global administrator accesses /feedback/preview/ to view the feedback, the payload executes in the dashboard origin, allowing same-origin XHR requests to exfiltrate countlyGlobal auth_token and csrf_token values. The fix includes server-side magic byte validation, content-type re-derivation at preview time, sandbox CSP headers, and stricter authorization checks.

## Affected products

- Countly countly-server before 24.05.50 and 25.03.44

## Timeline

- 2026-10-16: disclosed

## References

- [https://github.com/Countly/countly-server/commit/ae899f37bc6d70c1b44859756ce80a204ae72631](https://github.com/Countly/countly-server/commit/ae899f37bc6d70c1b44859756ce80a204ae72631)
- [https://github.com/Countly/countly-server/commit/fcb16c808c0fdb6dc99fe9c66de7fc560b3a9c41](https://github.com/Countly/countly-server/commit/fcb16c808c0fdb6dc99fe9c66de7fc560b3a9c41)

## Related threats

- [Countly Server unhandled stream error in image routes DoS](https://junglewise.ai/threats/cve-2026-42270-countly-server-is-the-server-side-part-of-countly-a-product)
- [Countly Server path traversal in data migration deletion](https://junglewise.ai/threats/cve-2026-42269-countly-server-is-the-server-side-part-of-countly-a-product)
- [Countly countly-server path traversal in image routes](https://junglewise.ai/threats/cve-2026-41582-countly-server-is-the-server-side-part-of-countly-a-product)