{"id":"CVE-2026-6282","state":"PUBLISHED","title":"A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access fi","description":"A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access files belonging to other users on the same device.","publishedAt":"2026-05-13T14:15:15.311Z","updatedAt":"2026-05-13T18:28:18.601Z","severity":{"score":8.6,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","source":"lenovo"},"assigner":"lenovo","products":["Lenovo Personal Cloud T2s","Lenovo Personal Cloud T2Pro","Lenovo Personal Cloud X1s","Lenovo Home Storage Hub T20","Lenovo Home Storage Hub X20","Lenovo Personal Cloud T1","Lenovo Personal Cloud A1","Lenovo Personal Cloud A1s","Lenovo Personal Cloud T2","Lenovo Personal Cloud X1"],"affected":[{"vendor":"Lenovo","product":"Personal Cloud T2s","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.5.6.t2s.3","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud T2Pro","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.4.8.t2pro.2","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud X1s","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.4.8.x1s.2","versionType":"custom"}]},{"vendor":"Lenovo","product":"Home Storage Hub T20","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.5.8.t20.1","versionType":"custom"}]},{"vendor":"Lenovo","product":"Home Storage Hub X20","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.4.4.x20.1","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud T1","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.4.0.t1.6","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud A1","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.4.2.a1.3","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud A1s","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.5.6.a1s","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud T2","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.4.5.t2.2","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud X1","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.4.7.x1.1","versionType":"custom"}]}],"references":["https://iknow.lenovo.com.cn/detail/440274","https://pc.lenovo.com.cn/tips/Ann/t1_eol.html"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/6xxx/CVE-2026-6282.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-6282","state":"PUBLISHED","datePublished":"2026-05-13T14:15:15.311Z","dateUpdated":"2026-05-13T18:28:18.601Z","assignerShortName":"lenovo","assignerOrgId":"da227ddf-6e25-4b41-b023-0f976dcaca4b","dateReserved":"2026-04-14T14:42:10.875Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access files belonging to other users on the same device."}],"affected":[{"vendor":"Lenovo","product":"Personal Cloud T2s","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.5.6.t2s.3","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud T2Pro","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.4.8.t2pro.2","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud X1s","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.4.8.x1s.2","versionType":"custom"}]},{"vendor":"Lenovo","product":"Home Storage Hub T20","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.5.8.t20.1","versionType":"custom"}]},{"vendor":"Lenovo","product":"Home Storage Hub X20","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.4.4.x20.1","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud T1","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.4.0.t1.6","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud A1","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.4.2.a1.3","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud A1s","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.5.6.a1s","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud T2","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.4.5.t2.2","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud X1","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.4.7.x1.1","versionType":"custom"}]}],"references":[{"url":"https://iknow.lenovo.com.cn/detail/440274"},{"url":"https://pc.lenovo.com.cn/tips/Ann/t1_eol.html"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":8.6,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseSeverity":"HIGH","baseScore":8.1,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","lang":"en","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","type":"CWE"}]}],"providerMetadata":{"shortName":"lenovo","orgId":"da227ddf-6e25-4b41-b023-0f976dcaca4b","dateUpdated":"2026-05-13T14:15:15.311Z"},"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:personal_cloud_t2s:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"5.5.6.t2s.3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:personal_cloud_t2pro:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"5.4.8.t2pro.2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:personal_cloud_x1s:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"5.4.8.x1s.2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:home_storage_hub_t20:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"5.5.8.t20.1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:home_storage_hub_x20:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"5.4.4.x20.1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:personal_cloud_t1:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndIncluding":"5.4.0.t1.6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:personal_cloud_a1:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndIncluding":"5.4.2.a1.3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:personal_cloud_a1s:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndIncluding":"5.5.6.a1s"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:personal_cloud_t2:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndIncluding":"5.4.5.t2.2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:personal_cloud_x1:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndIncluding":"5.4.7.x1.1"}]}]}],"solutions":[{"lang":"en","value":"Update device firmware to the version indicated in the advisory: https://iknow.lenovo.com.cn/detail/440274","supportingMedia":[{"type":"text/html","base64":false,"value":"Update device firmware to the version indicated in the advisory: https://iknow.lenovo.com.cn/detail/440274"}]}],"credits":[{"lang":"en","value":"Lenovo thanks Wang Jincheng, Professor Yu Le from Nanjing University of Posts and Telecommunications and Professor Luo Xiapu from The Hong Kong Polytechnic University","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.0-beta"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-13T18:28:11.322715Z","id":"CVE-2026-6282","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-13T18:28:18.601Z"}}]}}}