CVE-2026-6282 — Lenovo / Personal Cloud T2s

Description (CNA)

A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access files belonging to other users on the same device.

Affected (CNA)

Vendor / product	Versions
Lenovo / Personal Cloud T2s	affected 0 before 5.5.6.t2s.3
Lenovo / Personal Cloud T2Pro	affected 0 before 5.4.8.t2pro.2
Lenovo / Personal Cloud X1s	affected 0 before 5.4.8.x1s.2
Lenovo / Home Storage Hub T20	affected 0 before 5.5.8.t20.1
Lenovo / Home Storage Hub X20	affected 0 before 5.4.4.x20.1
Lenovo / Personal Cloud T1	affected 0 through 5.4.0.t1.6
Lenovo / Personal Cloud A1	affected 0 through 5.4.2.a1.3
Lenovo / Personal Cloud A1s	affected 0 through 5.5.6.a1s
Lenovo / Personal Cloud T2	affected 0 through 5.4.5.t2.2
Lenovo / Personal Cloud X1	affected 0 through 5.4.7.x1.1

CWE

CWE-22

References

https://iknow.lenovo.com.cn/detail/440274
https://pc.lenovo.com.cn/tips/Ann/t1_eol.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.