EUVD-2026-58056
GHSA-f95j-cwmr-fqw7
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector with low-privilege requirement; no confidentiality impact; high integrity and availability from unconstrained elevated-privilege file deletion.
Primary rating from Vendor (lenovo).
CVSS VectorVendor: lenovo
Lifecycle Timeline
2DescriptionCVE.org
An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges.
AnalysisAI
Arbitrary file deletion with elevated privileges is possible in the VantageCoreAddin component of Lenovo Vantage and Lenovo Commercial Vantage via an improper link following (symlink) attack. A local authenticated user operating with low privileges can exploit this to delete files outside their authorized scope by placing a malicious symbolic or hard link in a path the addin traverses with elevated rights. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
CWE-59 (Improper Link Resolution Before File Access) describes a class of vulnerabilities where software follows file system links - symbolic links (symlinks) or hard links - without validating that the resolved path remains within an intended directory boundary. In this case, the VantageCoreAddin subcomponent of Lenovo Vantage and Lenovo Commercial Vantage performs file deletion operations using elevated privileges without first confirming that the target path has not been redirected via a link. Affected product per CPE is cpe:2.3:a:lenovo:vantage:*:*:*:*:*:*:*:* - the wildcard version field indicates all tracked versions are affected. Lenovo Vantage is a system management and update utility pre-installed on Lenovo consumer and commercial endpoints, meaning the VantageCoreAddin runs in a privileged context on the host system.
RemediationAI
The primary remediation is to apply the vendor-released patch referenced in the Lenovo security advisory at https://support.lenovo.com/us/en/product_security/LEN-223723. An exact fixed version number was not included in the available intelligence data, so administrators should consult the advisory directly to confirm the target update version. Lenovo Vantage typically updates automatically via the Microsoft Store or Lenovo Update utility; verify automatic updates are functioning on managed endpoints. As a compensating control where patching is not immediately possible, restricting local logon rights to only trusted administrator accounts on multi-user Lenovo systems would eliminate the low-privilege local user attack surface, though this may impact legitimate user workflows. Disabling or uninstalling Lenovo Vantage entirely is an option on endpoints where its system management features are not operationally required, with the trade-off of losing Lenovo driver and firmware update capabilities.
A privilege escalation vulnerability was reported in LenovoBatteryGaugePackage for Lenovo System Interface Foundation bu
Privilege escalation via symlink following in Lenovo Vantage and Lenovo Commercial Vantage allows a local authenticated
Arbitrary file write with elevated privileges exists in Lenovo Diagnostics and HardwareScanAddin components of Lenovo Va
Stored cross-site scripting in the Vantage WordPress theme up to version 1.20.32 allows authenticated contributors and h
A vulnerability was reported in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to r
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today