# CVE-2026-6282: Lenovo Personal Cloud Storage path traversal in file management

Source: https://junglewise.ai/threats/cve-2026-6282-lenovo-personal-cloud-storage-path-traversal-in-file-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-6282 · Severity: high · CVSS 8.1 · Published 2026-05-13

A security vulnerability has been identified in several Lenovo Personal Cloud Storage devices, which are used by consumers to store and manage personal files remotely. An attacker with a standard user account on the device could exploit this flaw to access, view, or move files belonging to other users. This could lead to the unauthorized exposure or loss of private data stored on the shared storage system.

Vendors: [Lenovo](https://junglewise.ai/threats/vendors/lenovo).

## Quick answers

**Is CVE-2026-6282 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6282 being exploited in the wild.

**How severe is CVE-2026-6282?** High severity, with a CVSS score of 8.1, published 13 May 2026.

**Which products and versions are affected?** Lenovo Personal Cloud Storage T1 (L-SSC201-*); Lenovo Personal Cloud Storage A1 (L-SSC101/L-SSC121); Lenovo Personal Cloud Storage X1 (L-SSC501-*); Lenovo Personal Cloud Storage T2 (L-SSC202-*); and 1 more.

**Is there a fix for CVE-2026-6282?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6282 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-6282?** Check whether you run Lenovo Personal Cloud Storage A1, Lenovo Personal Cloud Storage A1s, Lenovo Personal Cloud Storage T1 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper file path validation vulnerability (CWE-22) exists in the firmware of several Lenovo Personal Cloud Storage models. The flaw allows a remote authenticated attacker to bypass directory restrictions by providing manipulated file paths. By exploiting this, an attacker can perform unauthorized file operations, such as reading or moving data belonging to other user accounts on the same physical device. The vulnerability is particularly significant as several of the affected models (T1, A1, X1, T2, A1s) have reached End of Life (EOL) status, and Lenovo has indicated that security firmware updates for these specific models have been discontinued.

## Affected products

- Lenovo Personal Cloud Storage T1 (L-SSC201-*)
- Lenovo Personal Cloud Storage A1 (L-SSC101/L-SSC121)
- Lenovo Personal Cloud Storage X1 (L-SSC501-*)
- Lenovo Personal Cloud Storage T2 (L-SSC202-*)
- Lenovo Personal Cloud Storage A1s (L-SSC103-*)

## Timeline

- 2026-04-20: other: Lenovo issues EOL notice for affected models
- 2026-05-13: advisory: Initial disclosure by Lenovo and NVD publication

## References

- [https://iknow.lenovo.com.cn/detail/440274](https://iknow.lenovo.com.cn/detail/440274)
- [https://pc.lenovo.com.cn/tips/Ann/t1_eol.html](https://pc.lenovo.com.cn/tips/Ann/t1_eol.html)

## Related threats

- [Lenovo Personal Cloud Storage OS command injection](https://junglewise.ai/threats/cve-2026-6281-lenovo-personal-cloud-storage-os-command-injection)