Which versions of Lenovo Personal Cloud are affected by CVE-2026-6282?

Lenovo Personal Cloud Storage devices contain a path traversal vulnerability allowing authenticated users to access and modify files belonging to other users on the same device, creating risk of…. A patch is available.

How to fix or mitigate CVE-2026-6282?

Within 24 hours: Inventory all Lenovo Personal Cloud Storage and Home Storage Hub devices in use and document affected product models and firmware versions. Within 7 days: Implement access restrictions by limiting device usage to single-user environments where possible, or segregating multi-user access by disabling cross-user file visibility through device settings if available; contact Lenovo support for interim guidance. Within 30 days: Monitor Lenovo security advisories for vendor patch release; prepare deployment plan for immediate patching upon availability; consider temporary isolation of affected devices handling sensitive data if multi-user access cannot be eliminated.

Lenovo Personal Cloud CVE-2026-6282

Q: What is the CVSS score of CVE-2026-6282?

CVE-2026-6282 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-30041 HIGH

Path Traversal (CWE-22)

2026-05-13 lenovo

GHSA-m6vj-6h49-wg69

Path Traversal Lenovo

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 13, 2026 - 16:33 EUVD

Analysis Updated

May 13, 2026 - 16:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

8.1 (HIGH) 8.6 (HIGH)

Analysis Generated

May 13, 2026 - 16:01 vuln.today

CVE Published

May 13, 2026 - 14:15 nvd

HIGH 8.1

DescriptionCVE.org

A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access files belonging to other users on the same device.

AnalysisAI

Path traversal in Lenovo Personal Cloud Storage devices allows authenticated remote attackers to move or access files belonging to other users on the same device, enabling unauthorized data disclosure and modification across user boundaries. Affects multiple product lines including Personal Cloud (T1, T2, T2S, T2Pro, X1, X1S, A1, A1S) and Home Storage Hub (T20, X20). CVSS 8.6 reflects high confidentiality and integrity impact with low attack complexity. No active exploitation confirmed in CISA KEV at time of analysis, and EPSS data not available for this 2026 CVE identifier.

Technical ContextAI

This vulnerability stems from improper file path validation (CWE-22: Path Traversal) in Lenovo's Personal Cloud Storage platform. Path traversal vulnerabilities occur when applications fail to properly sanitize user-supplied file path inputs, allowing attackers to use special characters (like ../ sequences) or absolute paths to access files outside their intended directory scope. In multi-tenant storage systems like Lenovo Personal Cloud, proper path validation is critical for maintaining isolation between different users' data stores. The affected CPE entries indicate this is a platform-wide issue affecting Lenovo's entire consumer NAS product line, including T-series (T1, T2, T2S, T2Pro), X-series (X1, X1S), A-series (A1, A1S), and Home Storage Hub models (T20, X20). The CVSS 4.0 vector shows network-accessible exploitation with low complexity and no user interaction required once authenticated.

RemediationAI

Users should immediately check Lenovo's official advisory at https://iknow.lenovo.com.cn/detail/440274 for firmware updates addressing this path traversal vulnerability. For devices receiving updates, apply the latest firmware version through the device's administrative interface following Lenovo's upgrade procedures. For the Personal Cloud T1 model, which has reached end-of-life status (https://pc.lenovo.com.cn/tips/Ann/t1_eol.html), no patch may be available; users should migrate data to supported models or alternative storage solutions. As interim mitigation until patches are applied: restrict user account creation to only trusted individuals, regularly audit user account lists and remove unnecessary accounts, implement strong unique passwords for all accounts to prevent credential compromise, monitor device access logs for unusual file access patterns, consider network segmentation to limit device accessibility to trusted networks only, and disable remote access features if not required. Each mitigation trades convenience for security: removing remote access eliminates legitimate external usage, account restrictions limit device utility in multi-user households, and log monitoring requires manual review effort.