Countly Server EUVD-2026-102915

Requires an authenticated Countly account possessing the data-migration permission (application administrator or a user explicitly granted migration rights) and that the data_migration plugin be enabled; the attacker then supplies a malicious exportid to the migration-deletion route in plugins/data_migration/api/api.js, which forwards it to clean_up_data in data_migration_helper.js without the path validation added in the fix. Exploitation is limited by that privileged role requirement - an unauthenticated or non-migration user cannot reach the sink - and by the deletion only affecting files/directories writable by the Countly server process; there is no confidentiality exposure, only destructive file/tree removal. Instances already upgraded to 24.05.50 or 25.03.44 (which add sanitizeFilename-based containment checks) are not affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) describes a network-reachable, low-complexity attack that requires an authenticated account holding data-migration permission (PR:L) and no user interaction, with high integrity and availability impact but no confidentiality loss - consistent with a path-traversal-driven arbitrary file/directory deletion rather than data theft. No EPSS score, CISA KEV listing, or POC were supplied, so by the precision rules this is 'no public exploit identified at time of analysis'; the fix commits (764e2a1 / b652ee8) are the primary confirmed evidence. The real-world priority is moderate rather than severe: exploitation is gated behind an authenticated privileged role (admin or migration-permission user), which sharply narrows the threat population to insiders or attackers who have already compromised a privileged session, so this is better treated as a privilege-boundary/defense-in-depth fix than an externally wormable flaw. Note a mild tension between the CWE-22 path-traversal classification and the C:N rating - the bug enables destructive deletion, not file disclosure, so the high score is driven entirely by integrity/availability, which is correctly reflected in the vector.

An authenticated Countly user who has (or has gained) the data-migration permission invokes the migration-deletion API with a crafted exportid containing path-traversal sequences; the unvalidated identifier is concatenated into a filesystem path that resolves outside the intended import directory and is passed to a recursive remove, deleting arbitrary writable files or whole directory trees. The result is data loss or service disruption for the Countly instance. No public exploit code was identified, but the patch diff clearly discloses the vulnerable sink and the exact validation that was missing.