Countly Server Fixes Critical Stored XSS Flaw in Star Rating Plugin

Countly has released security updates for its server-side product analytics solution to address a critical stored cross-site scripting vulnerability. The flaw, identified as CVE-2026-44977, allows attackers to inject malicious content through the star-rating plugin's feedback mechanism. This issue impacts installations running versions prior to 24.05.50 and those between 25.03 and 25.03.44.

The vulnerability exists in the api.js file within the star-rating plugin, where a non-global administrator can upload feedback files containing attacker-controlled active content. According to the National Vulnerability Database, the server trusts the MIME type supplied by the attacker during this upload process. The frontend component, specifically app.js, then serves this stored content publicly from the feedback/preview/ endpoint.

Technical Details of the Vulnerability

When a global administrator opens the preview of the uploaded feedback, the browser executes the injected payload within the Countly origin. This execution exposes sensitive authenticated session capabilities, including the user's auth_token and csrf_token values. The flaw is classified under CWE-79, indicating improper neutralization of input during web page generation. The National Vulnerability Database assigns the issue a CVSS score of 9, categorizing it as critical severity.

The attack vector requires the initial action of a non-global application administrator who has access to the uploadFeedbackFile function. Once the malicious file is stored, any global administrator viewing the preview becomes a victim of the stored XSS attack. The attacker gains access to the administrator's session tokens, effectively hijacking their privileges within the analytics platform. This allows for further exploitation of the application's administrative features.

Affected Versions and Patches

Organizations using Countly Server must check their current version to determine if they are exposed to CVE-2026-44977. The vulnerability affects all versions prior to 24.05.50. Additionally, versions in the 25.03 branch are affected if they are lower than 25.03.44. The vendor has confirmed that the issue is fixed in the specific release versions of 24.05.50 and 25.03.44. Users of other version branches or older builds remain at risk until they migrate to the patched releases.

The fix addresses the way the star-rating plugin handles MIME types and serves stored content. By updating to the specified versions, administrators ensure that the server no longer trusts the supplied MIME type blindly. This prevents the execution of attacker-controlled content when previews are accessed. The update is essential for maintaining the integrity of administrative sessions and preventing token theft within the Countly environment.

What should you do?

Administrators should immediately verify their Countly Server version against the affected ranges. If the installation is older than 24.05.50 or falls within the vulnerable 25.03 range, an update is required. Organizations should prioritize patching systems that are exposed to internet-facing networks or accessible by semi-privileged users. Monitoring for unusual administrative activity may help detect potential exploitation before patches are applied.