CVE-2026-6282: Lenovo Personal Cloud T2s, обхождане на път

Описание

Оригинално описание

A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access files belonging to other users on the same device.

Засегнати продукти

• Lenovo Personal Cloud T2s: преди 5.5.6.t2s.3
• Lenovo Personal Cloud T2Pro: преди 5.4.8.t2pro.2
• Lenovo Personal Cloud X1s: преди 5.4.8.x1s.2
• Lenovo Home Storage Hub T20: преди 5.5.8.t20.1
• Lenovo Home Storage Hub X20: преди 5.4.4.x20.1
• Lenovo Personal Cloud T1: до 5.4.0.t1.6
• Lenovo Personal Cloud A1: до 5.4.2.a1.3
• Lenovo Personal Cloud A1s: до 5.5.6.a1s
• Lenovo Personal Cloud T2: до 5.4.5.t2.2
• Lenovo Personal Cloud X1: до 5.4.7.x1.1

Вид слабост

• CWE-22 Неправилно ограничаване на път до позволена директория

История

Други уязвимости в Lenovo Personal Cloud T2s

• 8.8CVE-2026-6281

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-6282
• https://nvd.nist.gov/vuln/detail/CVE-2026-6282
• https://iknow.lenovo.com.cn/detail/440274
• https://pc.lenovo.com.cn/tips/Ann/t1_eol.html