Lenovo Personal Cloud CVE-2026-6282

Exploitation requires valid authenticated credentials to the Lenovo Personal Cloud Storage device (PR:L in CVSS vector indicates low-privileged user access is sufficient). The attacker must have network connectivity to the device's management interface or file access APIs (AV:N), which may be accessible via local network, remote access features if enabled, or cloud synchronization services. No special product features need to be enabled beyond normal multi-user file storage functionality, and no user interaction is required (UI:N). The vulnerability exists in the core file path validation routines used for file operations across user directories. Exploitation is limited by the requirement for pre-existing account credentials; external unauthenticated attackers cannot exploit this directly but could leverage it after credential compromise through other means such as weak passwords, social engineering, or account sharing practices common in home/SOHO environments.

This vulnerability presents moderate-to-high real-world risk despite the 8.6 CVSS score. The CVSS vector (AV:N/AC:L/PR:L) indicates network-based exploitation requiring only low-privileged authentication with no additional complexity, making it readily exploitable by any authenticated user including those with guest or limited accounts. The high confidentiality and integrity impacts (VC:H/VI:H) with no scope change (SC:N) reflect that attackers can read and modify other users' files within the device boundary. However, several factors moderate the risk: exploitation requires valid credentials (PR:L), limiting the attack surface to existing legitimate users or compromised accounts; the vulnerability affects consumer NAS devices rather than enterprise infrastructure, reducing organizational exposure; and no active exploitation is confirmed in CISA KEV, suggesting this has not been widely weaponized. The primary risk scenario involves malicious insiders, compromised guest accounts, or family members with legitimate access exploiting path traversal to access private files of other household or small business users. EPSS data is unavailable as this appears to be a future-dated CVE identifier, preventing automated exploitation probability assessment. Organizations using these devices in SOHO or small business contexts should prioritize remediation, while home users should assess based on their trust model for other device users.

An attacker with a low-privileged account on a Lenovo Personal Cloud device (such as a guest user, former family member, or compromised limited account) crafts API requests or file operation commands containing path traversal sequences (e.g., ../../other_user/private_documents/) to bypass directory restrictions. The inadequate path validation allows the attacker to enumerate, read, modify, or relocate files belonging to other users on the same device, accessing confidential documents, personal photos, or business data stored by other family members or small office users. Depending on the specific API affected, the attacker could exfiltrate sensitive data or manipulate files to cause integrity violations. No proof-of-concept code is publicly available at time of analysis, but the low attack complexity suggests exploitation does not require sophisticated techniques beyond understanding the device's file operation APIs.