8.6
High
CVE-2026-6282 A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices…
Description
A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access files belonging to other users on the same device.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Personal Cloud T2s 5.5 | earliest → < 5.5.6.t2s.3 | 5.5.6.t2s.3 |
| Personal Cloud T2Pro 5.4 | earliest → < 5.4.8.t2pro.2 | 5.4.8.t2pro.2 |
| Personal Cloud X1s 5.4 | earliest → < 5.4.8.x1s.2 | 5.4.8.x1s.2 |
| Home Storage Hub T20 5.5 | earliest → < 5.5.8.t20.1 | 5.5.8.t20.1 |
| Home Storage Hub X20 5.4 | earliest → < 5.4.4.x20.1 | 5.4.4.x20.1 |
| Personal Cloud T1 5.4 | earliest → 5.4.0.t1.6 | No fix stated |
| Personal Cloud A1 5.4 | earliest → 5.4.2.a1.3 | No fix stated |
| Personal Cloud A1s 5.5 | earliest → 5.5.6.a1s | No fix stated |
| Personal Cloud T2 5.4 | earliest → 5.4.5.t2.2 | No fix stated |
Show the other branch Hide the other branch
| Product | Affected versions | Fixed in |
|---|---|---|
| Personal Cloud X1 5.4 | earliest → 5.4.7.x1.1 | No fix stated |