{"metadata": {"vulnerability": "CVE-2026-41582", "count": 7, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 3}}, "data": [{"timestamp": "2026-04-21T14:15:21.959Z", "date_only": false, "value": "2026-04-21T14:15:21.959Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-41582", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-16T16:03:39.860Z", "date_only": false, "value": "2026-10-16T16:03:39.860Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-41582", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T16:03:39.860Z", "date_only": false, "value": "2026-10-16T16:03:39.860Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-41582", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T16:03:39.860Z", "date_only": false, "value": "2026-10-16T16:03:39.860Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-41582", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T16:09:01.673Z", "date_only": false, "value": "2026-10-16T16:09:01.673077Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117451452654315302", "record": "CVE-2026-41582", "field": "creation_timestamp", "uuid": "0f567d2e-dede-45fc-be8a-b5fead1d2efe", "content": "CVE-2026-41582 countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.\nhttps://www.cve.org/CVERecord?id=CVE-2026-41582https://github.com/Countly/countly-server/security/advisories/GHSA-fqgp-6rm9-8696https://github.com/Countly/countly-server/commit/405cb229ed37c744f6d61c42bf86fee5a7ee3530https://github.com/Countly/countly-server/commit/8004d29d3c789b70a79bf6e0380f0d546dbf42a9https://github.com/Countly/countly-server/releases/tag/24.05.50https://github.com/Countly/countly-server/releases/tag/25.03.44#Countly #countly-server#CVE_2026_41582#bot", "url": "https://infosec.exchange/users/cve/statuses/117451452654315302"}, {"timestamp": "2026-10-16T16:17:23.623Z", "date_only": false, "value": "2026-10-16T16:17:23.623", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-41582", "record": "FKIE_CVE-2026-41582", "field": "published"}, {"timestamp": "2026-10-16T20:02:37.630Z", "date_only": false, "value": "2026-10-16T20:02:37.630", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-41582", "record": "FKIE_CVE-2026-41582", "field": "lastModified"}]}