CVE-2026-44977

Name of the Vulnerable Software and Affected Versions countly-server versions prior to 24.05.50 countly-server versions prior to 25.03.44

Description A flaw in the star-rating plugin allows a non-global application administrator to upload active content via the uploadFeedbackFile function in the 'plugins/star-rating/api/api.js' endpoint. The system trusts the supplied MIME type, allowing the storage of malicious files. Subsequently, the 'plugins/star-rating/frontend/app.js' file serves this content from the 'feedback/preview/' path using the attacker-influenced Content-Type. If a global administrator views the preview, the payload executes within the Countly origin, potentially exposing session credentials such as auth token and csrf token.

Recommendations Update countly-server to version 24.05.50 or later. Update countly-server to version 25.03.44 or later.