Countly Stored XSS Vulnerability in Star-Rating Plugin

Countly, a product analytics solution, contains a stored XSS vulnerability in its star-rating plugin.

Before versions 24.05.50 and 25.03.44, a non-global application administrator can use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. The frontend handler in plugins/star-rating/frontend/app.js serves the stored content from feedback/preview/ with the attacker-influenced Content-Type.

If a global administrator opens the preview, the payload executes in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values.

• Affected: versions prior to 24.05.50 and 25.03.44
• Fixed: versions 24.05.50 and 25.03.44