CVE-2026-44977

Summary

A non-global administrator can upload malicious files that are later executed by a global administrator when previewing them, leading to remote code execution in the Countly context with full authenticated session access.

Exploitability

Moderately difficult to exploit as it requires both a non-global admin account and a global admin to view the malicious preview, but the attack chain is well-defined with public exploit references available.

Blast radius

High impact across all Countly installations using the star-rating plugin, potentially allowing attackers to gain full administrative control over analytics data and user sessions.

Detection

Monitor for unusual file uploads to the feedback/preview/ directory with suspicious MIME types, and watch for global administrator sessions accessing preview URLs with unexpected content types in server logs.

Prioritized remediation

Upgrade to 24.05.50 or 25.03.44 immediately to patch the file upload vulnerability in the star-rating plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.