The vulnerability is a relative path traversal flaw in Satel Netco Design's data import. An authenticated user possessing Viewer privileges can walk out of the contained directory and read files outside that directory. Using responses from the application the attacker can confirm the existence of those external files. The weakness is a classic Path Traversal problem (CWE-23). The result is unauthorized read access to any file the web server can reach, such as configuration files or logs, but it does not grant code execution or privilege escalation.

The flaw exists in all releases of Satel Netco Design before version 2.1.7. Users running earlier versions must be aware that the susceptible data import feature can expose files beyond the intended data directory. The vendor reports this for all local instances of the application, regardless of deployment size.

The CVSS score of 5.3 categorizes the issue as moderate. EPSS is not available and the vulnerability is not listed in CISA's KEV catalog, indicating no known widespread exploitation. The attack requires authentication, an account that has been granted Viewer role, and access to the data import function. Because it does not allow arbitrary code execution, the risk is mainly in data disclosure. The likelihood of exploitation depends on how many sites run older versions and how many users hold Viewer access. Without these prerequisites the vulnerability cannot be leveraged.