{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "24.05.50"
              },
              {
                "introduced": "25.03"
              },
              {
                "fixed": "25.03.44"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "e702a104d7616b1a96458da9fbf36144c5dd5ef4"
            },
            {
              "introduced": "5890b94d9783feffa3d2acafba1d94d67b2ae4e6"
            },
            {
              "fixed": "6050a3b1bcb0376701dbf68e346ac261363f5dfa"
            }
          ],
          "repo": "https://github.com/countly/countly-server",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-fqgp-6rm9-8696"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41582.json"
  },
  "details": "countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.",
  "id": "CVE-2026-41582",
  "modified": "2026-10-17T02:30:52.309826967Z",
  "published": "2026-10-16T16:03:39.860Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41582.json"
    },
    {
      "type": "FIX",
      "url": "https://github.com/Countly/countly-server/commit/405cb229ed37c744f6d61c42bf86fee5a7ee3530"
    },
    {
      "type": "FIX",
      "url": "https://github.com/Countly/countly-server/commit/8004d29d3c789b70a79bf6e0380f0d546dbf42a9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Countly/countly-server/releases/tag/24.05.50"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Countly/countly-server/releases/tag/25.03.44"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/Countly/countly-server/security/advisories/GHSA-fqgp-6rm9-8696"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41582"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files"
}