This vulnerability (CWE-22) in Lenovo App Store involves improper limitation of a pathname to a restricted directory, enabling a local authenticated user to perform path traversal attacks. This could lead to arbitrary code execution on the affected system. The vulnerability is specific to the Lenovo App Store product distributed in China. The CVSS 4.0 vector indicates local attack vector with low attack complexity, requiring privileges and user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

A local authenticated user can exploit this path traversal vulnerability to execute arbitrary code, potentially compromising system confidentiality, integrity, and availability. This could lead to unauthorized system control or data manipulation within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local user access to trusted users only and monitor for suspicious activity related to the Lenovo App Store. Avoid executing untrusted code or files through the application.