An authenticated delete_import request in Countly server versions prior to 24.05.50 and 25.03.44 lacks proper path validation. The endpoint forwards a user‑controlled export identifier to a cleanup routine that concatenates the identifier into a filesystem path and invokes a recursive removal. An application administrator or any user with migration permissions can thus craft a request that causes the server to delete arbitrary writable files or entire directory trees, resulting in data loss or service disruption. The vulnerability is a classic path traversal flaw (CWE‑22).

Countly server, specifically all releases older than 24.05.50 and 25.03.44, are affected. The problem resides in the plugins/data_migration API handling of export identifiers.

The vulnerability is rated a high CVSS score of 8.1 and is not currently listed in the CISA KEV catalog. Exploitation requires authenticated access with migration privileges, so the attack is limited to privileged users. Once the flaw is leveraged, an attacker can delete critical configuration files or data directories, causing permanent loss and downtime. The lack of an EPSS score means the precise likelihood of exploitation is uncertain, but any environment exposing the delete_import endpoint to administrators or migration users represents a significant risk.