Key points
- CVE-2025-44977 allows stored cross-site scripting via manipulated file uploads in the star rating plugin.
- Attackers need only non-global administrator access to upload malicious content with trusted MIME types.
- Global administrators viewing the stored feedback preview execute the payload, exposing session tokens.
A critical vulnerability in Countly Server enables attackers to compromise global administrator sessions through a stored cross-site scripting flaw in the star rating plugin, according to the NVD record for CVE-2026-44977. The issue arises because the application trusts user-supplied MIME types during file uploads, allowing malicious scripts to be stored and later executed.
The vulnerability affects versions prior to 24.05.50 and 25.03.44. Specifically, the `uploadFeedbackFile` function in the plugin’s API allows non-global administrators to store attacker-controlled active content. The frontend then serves this content publicly from the feedback preview endpoint with the attacker-influenced Content-Type header. When a global administrator opens this preview, the browser executes the payload within the trusted Countly origin.
Attack mechanics and impact
The exploitation chain relies on the server failing to validate the true nature of uploaded files. By trusting the supplied MIME type, the system allows JavaScript or other executable content to be stored as if it were a benign asset. This stored content is then rendered in the browser of any user who views the preview, particularly privileged administrators.
Affected versions and scope
Countly Server versions earlier than 24.05.50 and those in the 25.03 series prior to 25.03.44 are affected. The flaw is rated CVSS 9, which is classified as critical. It maps to CWE-79, cross-site scripting, and specifically impacts the star rating plugin’s handling of feedback files.
What happens next
Countly has released fixes in versions 24.05.50 and 25.03.44. Administrators should verify their current server version and apply the relevant update immediately. Systems running older versions remain vulnerable to session hijacking attacks via the star rating plugin’s feedback feature.
Why this attack works
Stored cross-site scripting exploits occur when an application saves user input without proper sanitisation and later renders it in a browser context. Attackers inject scripts that execute when victims view the stored content. This technique serves the initial access or privilege escalation stage of an intrusion, allowing threat actors to steal session cookies or tokens from privileged users who trust the application interface. Teams usually mitigate this by enforcing strict input validation and output encoding.
What to do and how to stay safe: Countly
- Update Countly Server to version 24.05.50 or 25.03.44 to patch the vulnerability.
- Audit user permissions to ensure non-global administrators cannot upload files to sensitive endpoints.
- Monitor server logs for unusual file upload activity or requests to the feedback preview endpoint.
- Review web application firewall rules to block potentially malicious MIME types in uploads.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-44977?
It is a critical stored cross-site scripting vulnerability in Countly Server’s star rating plugin that allows session hijacking.
Which versions are affected?
Countly Server versions prior to 24.05.50 and versions 25.03 through 25.03.43 are affected.
Is a fix available?
Yes, the issue is fixed in versions 24.05.50 and 25.03.44.
