EUVD-2026-58057
GHSA-2mcq-jg3f-chqr
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local low-privilege symlink attack requiring no user interaction; no confidentiality impact; high integrity and availability loss from arbitrary file deletion by privileged process.
Primary rating from Vendor (lenovo).
CVSS VectorVendor: lenovo
Lifecycle Timeline
1DescriptionCVE.org
During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges.
AnalysisAI
Arbitrary file deletion with elevated privileges affects Lenovo Dock Manager across all tracked versions (CPE: cpe:2.3:a:lenovo:dock_manager:*:*:*:*:*:*:*:*). An authenticated local user can exploit this CWE-59 link-following flaw to redirect the application's privileged file deletion routine to arbitrary targets outside the user's permitted scope, threatening both system integrity and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a locally authenticated user account with at least standard (low-privileged) permissions on the host running Lenovo Dock Manager, consistent with CVSS 4.0 AV:L/PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 with metrics AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H appropriately reflects a locally constrained but meaningfully impactful flaw - arbitrary file deletion by a low-privileged user can remove critical OS or application binaries, security logs, or configuration files, producing high integrity and availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-supplied patch for Lenovo Dock Manager available at https://support.lenovo.com/us/en/solutions/ht037099#dm and review advisory LEN-223470 at https://support.lenovo.com/us/en/product_security/LEN-223470 for the specific fixed version number, which is not independently confirmed from the data provided and must be verified directly against the Lenovo advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Dock Manager
View allPrivilege escalation in Lenovo Dock Manager allows a local authenticated user to execute arbitrary code with elevated pr
Privilege escalation in Lenovo Dock Manager exposes local authenticated users to full system compromise via an improperl
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today