CVE-2025-13154 | THREATINT

Description

An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges.

PUBLISHED Reserved 2025-11-13 | Published 2026-01-14 | Updated 2026-01-15 | Assigner lenovo

MEDIUM: 6.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

MEDIUM: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem types

CWE-59: Improper Link Resolution Before File Access ('Link Following')

Product status

Default status

unaffected

Any version before 1.1.0.1111

affected

Credits

Lenovo thanks Alex Lee Tsz Hin @PwCHK and Manuel Kiesel (cyllective AG) / John Ostrowski (Compass Security) for reporting this issue. finder

References

support.lenovo.com/us/en/product_security/LEN-208293

cve.org (CVE-2025-13154)

nvd.nist.gov (CVE-2025-13154)

Download JSON