Vulnerability · Published May 13, 2026 · Assigned by lenovo
CVE-2026-6282
High 8.1
In plain English
A high-severity path traversal in Home Storage Hub T20 from Lenovo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.4%top 66.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access files belonging to other users on the same device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lenovo | Personal Cloud T2s | 0 – before 5.5.6.t2s.3 |
| Lenovo | Personal Cloud T2Pro | 0 – before 5.4.8.t2pro.2 |
| Lenovo | Personal Cloud X1s | 0 – before 5.4.8.x1s.2 |
| Lenovo | Home Storage Hub T20 | 0 – before 5.5.8.t20.1 |
| Lenovo | Home Storage Hub X20 | 0 – before 5.4.4.x20.1 |
| Lenovo | Personal Cloud T1 | 0 – through 5.4.0.t1.6 |
| Lenovo | Personal Cloud A1 | 0 – through 5.4.2.a1.3 |
| Lenovo | Personal Cloud A1s | 0 – through 5.5.6.a1s |
| Lenovo | Personal Cloud T2 | 0 – through 5.4.5.t2.2 |
| Lenovo | Personal Cloud X1 | 0 – through 5.4.7.x1.1 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N