CVE-2026-101024

Satel Netco Design versions before v2.1.7 contain a relative path traversal flaw (CWE-23) in the data export function. An authenticated user with only Viewer privileges can influence the export path and write content into file-system locations the application service can reach. Successful exploitation can create or modify files and, under certain conditions, lead to arbitrary code execution with the service's privileges. The issue is network-reachable with low attack complexity and no extra user interaction, and it is scored CVSS 4.0 8.7 (high) with high impact to confidentiality, integrity, and availability on the vulnerable system. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Upgrade Satel Netco Design to v2.1.7 or later. Until that is done, limit Viewer accounts, restrict network access to the application, and check service-writable paths for unexpected files created or changed through data export.