EUVD-2026-58057
GHSA-2mcq-jg3f-chqr
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local low-privilege symlink attack requiring no user interaction; no confidentiality impact; high integrity and availability loss from arbitrary file deletion by privileged process.
Primary rating from Vendor (lenovo).
CVSS VectorVendor: lenovo
Lifecycle Timeline
1DescriptionCVE.org
During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges.
AnalysisAI
Arbitrary file deletion with elevated privileges affects Lenovo Dock Manager across all tracked versions (CPE: cpe:2.3:a:lenovo:dock_manager:*:*:*:*:*:*:*:*). An authenticated local user can exploit this CWE-59 link-following flaw to redirect the application's privileged file deletion routine to arbitrary targets outside the user's permitted scope, threatening both system integrity and availability. The vulnerability was identified through Lenovo's own internal security assessment; a vendor patch is available via advisory LEN-223470, and no public exploit has been identified at time of analysis.
Technical ContextAI
CWE-59 (Improper Link Resolution Before File Access - 'Link Following') describes a class of vulnerabilities where a privileged process resolves symbolic or hard links prior to performing a file operation, allowing an unprivileged user to redirect that operation to an unintended target. Lenovo Dock Manager is a system utility that manages Lenovo docking station firmware and peripheral configuration; it runs with elevated OS privileges to interact with hardware interfaces and perform system-level file operations. The CPE string cpe:2.3:a:lenovo:dock_manager:*:*:*:*:*:*:*:* uses an open-ended wildcard with no bounded version range, indicating all tracked releases are considered affected. The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N confirms that exploitation is local, requires only a standard low-privileged account, and involves no special attack preconditions or required user interaction beyond initiating the vulnerable operation.
RemediationAI
Apply the vendor-supplied patch for Lenovo Dock Manager available at https://support.lenovo.com/us/en/solutions/ht037099#dm and review advisory LEN-223470 at https://support.lenovo.com/us/en/product_security/LEN-223470 for the specific fixed version number, which is not independently confirmed from the data provided and must be verified directly against the Lenovo advisory. If immediate patching is not feasible, restrict local interactive and remote shell access to the host running Dock Manager to the minimum necessary accounts, since exploitation requires a locally authenticated low-privileged user; this reduces the attack surface but does not eliminate the vulnerability. Monitoring file system events generated by the Dock Manager process via endpoint detection and response tooling can provide a compensating detection layer in the interim, though this will not prevent a successful exploit and may generate noise in environments where Dock Manager performs routine file operations.
More in Dock Manager
View allPrivilege escalation in Lenovo Dock Manager allows a local authenticated user to execute arbitrary code with elevated pr
Privilege escalation in Lenovo Dock Manager exposes local authenticated users to full system compromise via an improperl
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today