A stored Cross‑Site Scripting flaw in Countly server allows a non‑global application administrator to upload a feedback file that contains attacker controlled JavaScript. The server trusts the MIME type supplied by the uploader and later serves the stored content from /feedback/preview/ with the attacker‑chosen Content‑Type header. When a global administrator opens the preview URL, the malicious script executes in the Countly origin context, giving the attacker access to the authenticated session, including auth_token and csrf_token values, effectively enabling session hijacking and the ability to act as the global admin.

Countly server versions prior to 24.05.50 and prior to 25.03.44 contain this vulnerability. The flaw resides in the star‑rating plugin’s uploadFeedbackFile API and the feedback preview endpoint, which together expose user supplied content without proper sanitisation.

The CVSS score of 9 indicates a critical severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack path is straightforward: a malicious, non‑global administrator can upload the payload, and only a global administrator viewing the preview triggers the exploit. Because no special network or privilege requirements are needed beyond normal administrative access, the vulnerability is highly likely to be abused once disclosed.