Lenovo Personal Cloud devices contain an improper file path validation flaw that allows a remote authenticated user to move or view files belonging to other users on the same device. The vulnerability grants an attacker privilege over confidential user data, enabling data theft, modification, or deletion. It is a direct bypass of the intended access control boundaries and poses a significant confidentiality and integrity risk.

The flaw affects Lenovo Home Storage Hub T20 and X20 as well as Lenovo Personal Cloud models A1, A1s, T1, T2, T2Pro, T2s, X1, and X1s. No version specific details were provided; any firmware iterations lacking the published patch are potentially vulnerable.

With a CVSS score of 8.6 the vulnerability is considered high severity. EPSS data is not available and the vulnerability is not listed in CISA KEV, suggesting that public exploitation is not confirmed. Attackers must first authenticate to the device, typically via the web interface or API, and then exploit the path validation weakness to access or alter another user’s files. The attack surface is limited to devices that expose network connectivity, but once accessed, control over all user file data is possible.