CVE-2026-6282

A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access files belonging to other users on the same device.

Score

CVSS 4.0 8.6 High

Status

Awaiting Analysis - psirt@lenovo.com

Published

2026-05-13

Last modified

2026-10-26

Weaknesses

CWE-22

Affected products

• Home Storage Hub T20 (Lenovo)
• Home Storage Hub X20 (Lenovo)
• Personal Cloud A1 (Lenovo)
• Personal Cloud A1s (Lenovo)
• Personal Cloud T1 (Lenovo)
• Personal Cloud T2 (Lenovo)
• Personal Cloud T2pro (Lenovo)
• Personal Cloud T2s (Lenovo)
• Personal Cloud X1 (Lenovo)
• Personal Cloud X1s (Lenovo)

References

• https://iknow.lenovo.com.cn/detail/440274
• https://pc.lenovo.com.cn/tips/Ann/t1_eol.html