Lenovo Filez
CVE-2026-2368
HIGH
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network interception required; user must initiate a Filez session; no attacker authentication needed; full RCE impact with no scope change.
Primary rating from Vendor (lenovo).
CVSS VectorVendor: lenovo
Lifecycle Timeline
5DescriptionCVE.org
An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of intercepting network traffic to execute arbitrary code.
AnalysisAI
Improper TLS certificate validation in Lenovo Filez (Windows and Android) enables an adjacent-network attacker who can intercept application traffic to present a fraudulent certificate, inject malicious server responses, and achieve arbitrary code execution on the victim's device. Both Windows and Android clients are confirmed affected per NVD CPE data with no version upper bound specified. No public exploit code has been identified and EPSS probability is 0.01%, though the impact if exploitation succeeds is fully classified as high across confidentiality, integrity, and availability.
Technical ContextAI
CWE-295 (Improper Certificate Validation) describes a class of flaws where an application fails to adequately verify one or more properties of a TLS/SSL certificate - such as the chain of trust, hostname binding, expiry, or revocation status - before trusting the server. Lenovo Filez is a file-sharing and transfer platform available on Windows (cpe:2.3:a:lenovo:filez:*:*:*:*:*:windows:*:*) and Android (cpe:2.3:a:lenovo:filez:*:*:*:*:*:android:*:*). When the client bypasses or incompletely performs certificate validation, a machine-in-the-middle adversary who has already achieved traffic interception can substitute a forged or self-signed certificate and the client will accept the fraudulent server identity. This allows the attacker to control the application data stream and deliver executable payloads in place of legitimate server responses, leading to arbitrary code execution on the end-user device.
RemediationAI
Patch available per vendor advisory - consult https://www.filez.com/securityPolicy for the current patched release, as no specific fix version number is confirmed in the available data. Until a patched build is confirmed and deployed, organizations should prohibit Filez usage on untrusted or shared network segments such as public Wi-Fi, hotel networks, or conference infrastructure where traffic interception is feasible; this directly eliminates the adjacent-network attack vector. Routing all Filez traffic through a trusted corporate VPN is a viable compensating control but requires enforceable policy and endpoint management to be effective - unenforced VPN-only policies provide no protection if users bypass them. For Android deployments, enabling strict certificate pinning at the enterprise mobile device management (MDM) layer, where supported, can partially compensate. Disabling the application entirely for field workers on unmanaged networks is the most effective interim control. The VulnDB advisory at https://vuldb.com/?id.350643 may provide additional vendor response timelines.
Lenovo Filez fails to properly validate SSL/TLS certificates, enabling network-positioned attackers to intercept encrypt
A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could all
Same weakness CWE-295 – Improper Certificate Validation
View allShare
External POC / Exploit Code
Leaving vuln.today