‹ Back to list

CVE-2026-42270

Status: Awaiting AnalysisHigh (7.5)—
Severity7.5High · CVSS 3.1
Exploitation probability0.54 %higher than 44% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception, allowing repeated requests to keep the analytics API unavailable. The affected routes also include /appimages/*, /memberimages/*, and */screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.

CVSS

Base score
7.5
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.54 %
Percentile among all scored CVEs
44
Score date
10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vector AV:N/PR:N/UI:N sin interacción; una petición no autenticada provoca EISDIR y caída del proceso Node.js, dejando la API inaccesible (A:H).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Countly — Countly-serverAI

CWEs

References

Show 6 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-42270",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42270",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-16T16:52:07.011789Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Countly",
          "product": "countly-server",
          "versions": [
            {
              "status": "affected",
              "version": "< 24.05.50"
            },
            {
              "status": "affected",
              "version": ">= 25.03, < 25.03.44"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-16T16:17:23.940",
  "references": [
    {
      "url": "https://github.com/Countly/countly-server/commit/72f19bc5161117fa02a224bf9f7316bf42dae58d",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Countly/countly-server/commit/f9ad31480f94ee3ccc0f12708c8804be9c803f95",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Countly/countly-server/releases/tag/24.05.50",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Countly/countly-server/releases/tag/25.03.44",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Countly/countly-server/security/advisories/GHSA-86cv-qwp9-jwp3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Countly/countly-server/security/advisories/GHSA-86cv-qwp9-jwp3",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-248"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception, allowing repeated requests to keep the analytics API unavailable. The affected routes also include /appimages/*, /memberimages/*, and */screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44."
    }
  ],
  "lastModified": "2026-10-16T20:02:37.630",
  "sourceIdentifier": "security-advisories@github.com"
}