The vulnerability allows an unauthenticated attacker to perform a path traversal on public image and screenshot endpoints, enabling arbitrary reading of files stored on the server. This is a classic directory traversal flaw (CWE‑22). The server can expose sensitive configuration files, logs, or secrets, causing a significant confidentiality breach. The CVSS score of 7.5 reflects a high impact scenario because no authentication is required and any file accessible to the server process can be disclosed.

Affected installations are Countly server deployments running any version prior to 24.05.50 or 25.03.44. The flaw exists in the routes /appimages/*, /memberimages/*, */screenshots/*, /star‑rating/images/*, and /dashboards/images/screenshots/*. These endpoints, when served from a local storage backend, lack containment validation and thus allow directory traversal. The issue is mitigated in the 24.05.50 and 25.03.44 releases, which introduce proper path validation.

With no EPSS data available, the risk relies on the high CVSS score and the public nature of the endpoints. Because the affected routes are reachable without authentication, the likelihood of exploitation is high until the server is patched. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation yet, but the potential for privacy and integrity compromise remains. Prompt upgrade to a fixed release is essential to neutralize the risk.