EUVD-2026-58056
GHSA-f95j-cwmr-fqw7
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector with low-privilege requirement; no confidentiality impact; high integrity and availability from unconstrained elevated-privilege file deletion.
Primary rating from Vendor (lenovo).
CVSS VectorVendor: lenovo
Lifecycle Timeline
2DescriptionCVE.org
An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges.
AnalysisAI
Arbitrary file deletion with elevated privileges is possible in the VantageCoreAddin component of Lenovo Vantage and Lenovo Commercial Vantage via an improper link following (symlink) attack. A local authenticated user operating with low privileges can exploit this to delete files outside their authorized scope by placing a malicious symbolic or hard link in a path the addin traverses with elevated rights. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local authenticated session with at minimum low-privilege (standard user) access to the target system - this is confirmed by the CVSS 4.0 vector PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) yields a score of 6.9, reflecting a local attack with low complexity, low-privilege requirement, no user interaction, and high integrity and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the vendor-released patch referenced in the Lenovo security advisory at https://support.lenovo.com/us/en/product_security/LEN-223723. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
A privilege escalation vulnerability was reported in LenovoBatteryGaugePackage for Lenovo System Interface Foundation bu
Privilege escalation via symlink following in Lenovo Vantage and Lenovo Commercial Vantage allows a local authenticated
Arbitrary file write with elevated privileges exists in Lenovo Diagnostics and HardwareScanAddin components of Lenovo Va
A vulnerability was reported in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to r
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today