This vulnerability (CVE-2026-6282) involves improper limitation of a pathname to a restricted directory (CWE-22) in Lenovo Personal Cloud T2s devices. Specifically, the device's file path validation is insufficient, enabling a remote authenticated user to access or move files of other users on the same device. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity. No official fix or patch has been published by Lenovo as of the data provided.

Successful exploitation could allow an authenticated remote attacker to access or move files belonging to other users on the affected Lenovo Personal Cloud T2s device. This compromises confidentiality and integrity of user data stored on the device. There is no indication of availability impact or privilege escalation beyond the authenticated user level.

Patch status is not yet confirmed — check the Lenovo vendor advisory for current remediation guidance. Until an official fix is released, users should restrict remote access to trusted users only and monitor for unusual file access patterns. No official patch or temporary fix is currently available.