Lenovo App Store Path Traversal Flaw Rated High Severity

Lenovo disclosed CVE-2026-13103, a path traversal vulnerability in its China-only App Store that could let a local authenticated user run arbitrary code. The flaw is rated high severity with CVSS 7.3 and affects versions before 9.0.2930.0514 on Windows.

Source:NVD

Post

Lenovo App Store Path Traversal Flaw Rated High Severity

TL;DRAI · 60 sec read

Lenovo has disclosed a high-severity path traversal vulnerability in its App Store application that is distributed exclusively in the Chinese market.

A local authenticated user could execute arbitrary code. The flaw, tracked as CVE-2026-13103, carries a CVSS 3.1 base score of 7.3. Lenovo Group Ltd. assigned a CVSS 4.0 score of 7.0 with vector string CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

A local authenticated user could execute arbitrary code.

The vulnerability stems from improper limitation of a pathname to a restricted directory. It affects Lenovo App Store versions prior to 9.0.2930.0514 on Windows platforms.

The issue was reported directly by Lenovo Group Ltd. The National Vulnerability Database published the CVE record on July 16, 2026, the same day it was received from the vendor at 1:16:54 PM. NVD has not yet provided its own CVSS assessment and notes the record is not prioritized for enrichment due to resource concerns.

From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →

A reference to Lenovo's Chinese-language advisory is listed. The link points to https://iknow.lenovo.com.cn/detail/441419. No additional mitigation steps or patches are detailed in the NVD entry beyond the affected version range.

This marks the first public record for the vulnerability.

The weakness is classified as CWE-22. Lenovo lists the product status as affected for versions below the fixed build and unaffected for 9.0.2930.0514 and later.

This marks the first public record for the vulnerability. Users of the China-specific Lenovo App Store on Windows should monitor the referenced advisory for update instructions.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported

DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee

vulnerability Lenovo security

MORE IN TECH

NASA and SpaceX Prepare for Nancy Grace Roman Space Telescope Launch

NASA and SpaceX are targeting a 7:26 AM EDT Sunday liftoff of a Falcon Heavy from Kennedy Space Center carrying the Nancy Grace Roman Space Telescope. The observatory will travel to Sun-Earth L2, where its Wide Field and Coronagraph instruments will search for exoplanets and study dark energy.

Carhartt data breach exposes 12.9 million accounts

ShinyHunters published data from 12.9 million genuine Carhartt accounts after the apparel company refused a $3.3 million ransom. The breach, which also exposed records for more than 15,000 employees, originated from Carhartt's Databricks analytics platform.

Nvidia Agrees to Acquire Hugging Face for $12.9 Billion

Nvidia has agreed to acquire open-source AI platform Hugging Face for $12.9 billion according to The Information. The deal would expand Nvidia's reach into the software and model ecosystem while highlighting its bet on continued AI demand growth.