EUVD-2026-44976
GHSA-v9mr-vw95-5jgv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local authenticated low-privilege access (AV:L/PR:L) with required user interaction (UI:R) yielding full code execution, so high C/I/A and unchanged scope.
Primary rating from Vendor (lenovo).
CVSS VectorVendor: lenovo
Lifecycle Timeline
3DescriptionCVE.org
A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code.
AnalysisAI
Local code execution in Lenovo App Store (Chinese-market distribution only) lets an authenticated local user abuse a path traversal weakness to write or load files outside intended directories and run arbitrary code. The flaw was self-reported by Lenovo and carries a CVSS 4.0 base score of 7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high to confidentiality, integrity, and availability of the local system, but exploitation requires existing low-privilege local access plus user interaction.
Technical ContextAI
The affected component is the Lenovo App Store client application (cpe:2.3:a:lenovo:app_store), a vendor software-distribution/storefront utility shipped exclusively to the Chinese market. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal): the application does not properly neutralize traversal sequences (such as ../) in a file path it processes, allowing a supplied path to resolve outside the intended base directory. In an app-store/installer context this typically means a malicious package name, download path, or resource reference can be directed to an arbitrary filesystem location, and because the traversal ultimately leads to code execution, the untrusted path likely influences where an executable, library, or script is written or loaded from - turning a file-placement primitive into arbitrary code execution.
RemediationAI
Update the Lenovo App Store client to the fixed release per Lenovo's advisory at https://iknow.lenovo.com.cn/detail/441419; an exact patched version number is not included in the provided data, so treat the vendor advisory as the source of the specific fix build and apply the latest available client version. Patch status here is best described as 'Patch available per vendor advisory' since Lenovo self-reported and published guidance but no exact fix version was supplied. Until the update is deployed, reduce risk by restricting who has interactive local accounts on affected Chinese-market endpoints (the vulnerability needs a local authenticated user), and by discouraging users from running untrusted app-store packages or clicking prompts that trigger installs (the UI:P requirement means user interaction is part of the chain); on managed fleets consider removing or disabling the Lenovo App Store client where it is not needed, accepting the trade-off that users lose the vendor storefront and self-service updates it provides.
A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with eleva
Local code execution in Lenovo Legion Zone and the Lenovo App Store (China-market Windows builds) allows an authenticate
Local privilege escalation to arbitrary code execution affects Lenovo App Store, a software-distribution client shipped
An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to ex
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today