Personal Cloud X1 CVEs and Security Vulnerabilities

CVE-2026-6282

Improper File Path Validation in Lenovo Personal Cloud Allows User File Access Hijacking

A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access files belonging to other users on the same device.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Lenovo

Products

Home Storage Hub T20 Home Storage Hub X20 Personal Cloud A1 and 7 more

CVE-2026-6281

Remote Authenticated Command Injection Allowing Arbitrary Code Execution on Lenovo Personal Cloud Devices

A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary commands on the device.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed